skysight-inc/HackerNews huggingface dataset:
Totally agreed on the over-complexity and un-securability of TLS, that too often is deployed where something simpler should be used instead.

However, wouldn't OpenSSH be the thing spiped replaces most of the times? And that has a better security track record (I mean, better than OpenSSL for sure).
Thinking back on BASIC, what stands out most to me are the line numbers. At the time, I never understood the point; I mean, sure, you needed them for GOTO and GOSUB. But it just seemed like so much labor. And, of course, why not labels, names for subroutines? Other languages had them.

But when you think back on how assembly looked and worked at the time, you realize that the line numbers are sort of analogous to addresses in memory. If you were on a 6502, you might JMP to a point in memory. You'd do the same in BASIC, except instead of a point in memory, it was an arbitrary number you used for the line.

So, weirdly, my thoughts on BASIC today is not that it was really BASIC. Not even that it was necessarily a great beginner language, though some people treated it that way. It was an easier shorthand for assembly.
I have often thought that it would make sense for employees of different companies to pool any equity. You already take on enough risk being employed by a startup business without adding on your equity risk too.
"it's unclear what the motivation for running an instance of this kind of P2P application would be"

Incentivising P2P applications is one of the interesting problems Bitcoin could solve.

People have talked about building P2P storage applications using Bitcoin, which is essentially what this would be, except if you stop paying into the network the files should be transmitted to some 3rd party of your choosing instead of being destroyed.

Perhaps some splitting scheme such as Shamir's Secret Sharing could be layered on top.
https://news.ycombinator.com/item?id=7545952
and x-powered-by headers are worthless,why set them up?
... and no parent would have more kids just to receive more welfare money. Oh, wait.
> Look at a game like Utopia for example (you know the old browser based strategy game that was created by mehul). It was all about calculations and working in synergy with other people from all over the world (also somewhat about backstabbing, abusing and hacking of course). It was one of the bigger online browser games there was back then. If you compare to current online games like farmville and candycrush it's nothing the same and the types of people are nothing the same, why? Because it was different sorts of people that usually browsed the web back then. So yes, there was and has always been an original culture online that has gradually been merged with the mainstream people which has evolved internet into its' present form, and I don't disagree or agree with that, I just state it as a fact.

Have you never seen Eve Online? There's as much calculation and cooperation and backstabbing as in anything I've seen, it's just prettier now. And if subscribing to a game isn't your thing, there are a lot of deep web-based strategy games out there. Picking shit like candycrush is disingenuous; I could just as easily say that the early Web was useless because it had so many shitty Pokemon fan pages.
I starting learning how to write code in '91 (I was 10). My first language was LOGO, but after that I started learning BASIC. I remember trying to find any sort of books I could from the library, that talked about BASIC. It was tough going. I didn't have access to the internet (much less knew what it was). So I had to make do with these books that were often for different dialects of BASIC.

In those days I was enamored with graphics and the idea of creating games, and it was dead simple to do simple graphics in BASIC.

Although I haven't written any code in BASIC in over 10-12 years, it still holds a special place in my heart since it was the language that I used to realize my passion for programming and computers in general. I most definitely wouldn't be where I am today, if it wasn't for BASIC (and QBASIC).
Whoa, this seems horrifying.

One (selfish) question I have is whether this can affect primary key material stored in an HSM. I'm assuming not, but that the session key generated by the HSM would still be susceptible.
The Internet of Coffee: Blue Bottle Buys Tonx
Owns?
Don't use the functions from the map object, but keep a separate function reference for validation?

I mean if you want to cheat you always can. But that's not the point. Right now you can cheat using official apis.

Just use map._blah() for internal use

By the way: Same trick works for keys.
I wonder how many service providers with big OpenSSL deployments (cloudflare, google, facebook, etc.) will do the sane thing and roll their authenticity keys. I'm guessing zero.

(Assuming they are deployed in such a way that their long-term authenticity keys are in the memory space of the network service, and not kept on another system or HSM.)
Introducing App Coins
Would love to see a similar post for CS Core Concepts (think OOP, Data Structure & Algorithms etc). Anyone know of such a url? Thanks in advance.
if the app was fast , i'm sure everybody would be positive. IT is not.I dont even get 1 fps on my MCBOOK PRO. Explain me how i can enjoy beauty that way.
Any recommendations for alternatives to Disqus that have roughly feature parity and which allow me to pay them for their services?
A lot of people are doing spiped-like things using stunnel.
the article made it sound like the city/planning department was serving the eviction notice...not the landlord. Not sure how that would work though.
A couple more data points:

I'm running Fedora 19 and Arch on my main dev machines/VMs and as of this posting are considered up-to-date. Both are vulnerable:

[Fedora19] $ openssl version
OpenSSL 1.0.1e-fips 11 Feb 2013

[Arch] $ openssl version
OpenSSL 1.0.1f 6 Jan 2014
Does anyone know how Amazon's Elastic Load Balancers are affected? I can't find anything on the AWS site
I wonder if Google wanted this or Microsoft pushed for it.
I think Google Hangouts with the Xbox One and Kinnect would be a great combination.

Will Microsoft allow it when it would make Skype look bad or do they just want users on their platform? Youtube uploads suggests to me they want functionality from any source to get an edge on the competition.
Ouch. Does this mean almost every Debian 7 web server out there is probably vulnerable to having its private data for supporting HTTPS compromised?

https://security-tracker.debian.org/tracker/CVE-2014-0160

If so, that must be an awful lot of web servers, with a horrendous cost for everyone to buy new certificates etc. if there's no reliable way to determine what if anything was compromised.

Would any of our resident security experts like to suggest best practices under such circumstances?

(Edit: It looks like the page I linked above has been updated and a patch is going into Wheezy security as I write this.)

(Edit 2: Confirmed that Wheezy security updates now include openssl 1.0.1e-2+deb7u5 and related libssl changes.)
>But these arguments seem to lead to the conclusion that you shouldn't be an LP, not that you shouldn't take venture money.

I have a very limited understanding, but the impression I got is that VCs typically have short maturity dates and thus are riskier in nature, whereas PE funds typically have the luxury of biding their time. How this is structured, or why exactly is beyond my ken.

So upside being, VCs are incentivized to encourage larger risk taking than what would be otherwise optimal from the perspective of a bootstrapped founder.
Should the web be personalized?
The average person visits 2,646 web sites per month across 89 domains. That is 89 different voices that give the average person a cross-section of new and interesting topics that they may want to explore. What if all 89 voices said the same thing?
>This study certainly doesn't tell us what happens between a player and a fiddle over a long-term relationship, and this is an important factor.

No, it's not, because the same long-term relationship can happen between a player and a modern violin as well.
Nitpick: VCs are optimizing for % return, not on an dollar return basis.

I would say that the risk profile is not irrelevant: if you're betting that 1/10 of your investments are returning your fund, then just one miss is the difference between a good year and "I don't have a VC firm anymore". Compare that to betting that half of your investments are returning your fund: one miss is the difference between a good year and an "ehh" year.[0]

That's true; when you compare both of them to a 30x, the difference between a 1x and 0x is small. But what I'm saying is that at a $15m investment, very few VCs expect to see a 30x, and when you compare it vs. a 3x or a 5x acquisition, the difference between no money back and your 1x liquidation pref paying out is much larger, proportionally.

The same power law may apply, but you see more of the tails in when you have a much larger sample size. If there were just as many $15m investments happening as $20k investments, you'd see the same result, but there aren't.

Off-topic: are you the same Scott Klein I talked to over the summer re: statuspage.io?

[0] Of course, that glosses over different probabilities of success and failure, but what I'm trying to say is that VCs are risk averse.
awesome thanks, please post these on HN as you write them.
Believing homosexual behavior undermines society is predicated on a false premise: biblical morality.

Doing shitty things that undermine the lives of others is objectively evil.
Political positions involve decisions about how we use violence to structure society.

More germane to democratic industrialized 1st world nations, is how people choose to refrain from violence to structure society.

Someone who donated in support of a proposition to kill all the Jews is probably rightly labelled antisemitic, even if they are always polite face-to-face. And yes, surely, such a proposition wouldn't be constitutional

The "problem" is with your broad definition of intolerance, which you attempt to support with your (self-admitted) straw man involving a hypothetical proposition which would fit the legal (not just customary) definition of hate speech.

http://en.wikipedia.org/wiki/Hate_speech

There is a societal problem with supporting a proposition which could be defined as hate speech, which is directly dangerous and illegal. There is no societal problem with propositions which are constitutionally untenable. We have political mechanisms for dealing with that.

there's a problem with your framework and I don't see a trivial solution.

No, there was a problem with your straw man. Remove that, and you'll find that your position reduces to, "Society should not tolerate speech from people who are wrong." The problem is how such a thing would be adjudicated.

There's a problem with your framework. You don't see the solution because your position is effectively against free speech. You are only for speech you personally label as "tolerant." In a truly free society, one must be free to be wrong. That's the only way it can work.
In their defence, APR is problematic. It's misleading in itself.

APR is enforced to keep lenders from disguising the real costs of a loan using fees and such. It's an ethical advertising standard. But, disguising the real costs of a loan is not the only reason to use fees. Fees are also used because the lenders' costs are not just borrowing costs. There's a flat cost to processing a loan. That translates to a flat fee which can raise APR to seemingly horrendous rates.

Basically, loans don't scale linearly.

Maybe micro-finance should come up with it's own standard practice. People need to make some allowances though. 25% is not terrible in every context.
Don't be silly. According to the Bible, eight and a bunch of animals. (Noah, three sons, and four wives.)
Likewise for Ubuntu 13.10: OpenSSL 1.0.1e 11 Feb 2013

And the current beta of 14.04: OpenSSL 1.0.1f 6 Jan 2014
Yeah, I haven't seen any new RPMs for RHEL/CentOS/Fedora yet. Kinda concerning, since I'd expect vendors to be given advance notice and the chance to prep updates to coincide with the announcement.

All my RHEL5 boxes are running 0.9.8, though, at least.
I'm partial to "Pack my red box with five dozen quality jugs".
A stunning demonstration of the benefits of building a culture of contribution.
When I worked with high schoolers I liked to introduce them to python. The documentation, IMO, is clearly written and easily understood by programming novices. It's got OO, imperative and (limited) functional paradigms available. Graphics are fairly straightforward, for example the built in turtle graphics library. With IDLE it has a good, free, crossplatform IDE that's simple enough to not overwhelm new programmers, but provides every feature you really need. The REPL lets new programmers quickly explore different parts of the language and their programs. And for sticking with primarily imperative code (here I mean that the programmer isn't designing new objects, though they may be making use of existing ones), the syntax is ludicrously straightforward once they get past the mandatory whitespace and spaces versus tabs.
what hardware do you have?
> Believing homosexual behavior undermines society is predicated on a false premise: biblical morality.

And they think your morality is predicated on a false premise. The point is that I still expect them to treat you decently, and I expect you to treat them decently.

> Doing shitty things that undermine the lives of others is objectively evil.

Like petitioning to get them fired from their jobs? That kind of thing?
Bitcoin the hype-machine is dead; it's now "just another cryptocurrency." The successor to Bitcoin would be a successor hype-machine.
By either compiling & installing it with -DOPENSSL_NO_HEARTBEATS or waiting for the security fix to be backported by ubuntu devs. http://heartbleed.com/
iOS Game Dev Hackathon in San Francisco
My first approach to programming was Sinclair BASIC of a ZX Spectrum +3 . I learn soem stuff with a books of "BASIC for childrens", and the ZX spectrum +3 manual.
I remember doing a program to study multiplication tables, printing it, and then asking me for the values... Good old times.
The question is: how do you make it sound that good? Is that with commercial voices?
Top Shady Lawyers Who Give Law a Bad Name
CSS 3D MRI
The billion-dollar game dev trading post
Not affected directly on Mac OS:

OpenSSL 0.9.8y 5 Feb 2013
Yes. You can request Temporary Credentials for s3 service. However, the only secure way to do it is on server side not on client.
Second this - I think companies that offer year-round internships set themselves way ahead of the pack and get to choose from a very qualified and talented pool.
Working Around Import Errors in Python
Here's the patch/commit, I don't know why it's not linked form the OpenSSL changelog or heartbleed.com. A suspicious lack of transparency.

http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=...
Has anyone ever tried to read through SICP on a Kindle or other e-reader?

Or would it be pointless to read through the book without a REPL/command line next to it?
What if it was donation based, like lyft or uber?
Seriously. Google's stance on this has been childish at best. Time to grow up.
Yeah, I'm not sure how anyone could consider this a "Critical Vulnerability". It's kind of cool and slightly frightening that Amazon scans for API keys. I'd love to know how they're going about the scan though; maybe using excess capacity to do a crawl and analyzing the results? Maybe through Alexa?
Wyden Calls Former CIA Director’s Attack on Senator Feinstein “Outrageous”
How do you deal with interoperability? You Android clients use your Shiny frontend over HTTP? Have you used rserve?
Aren't you basically just talking about Smalltalk/Obj-C style message-passing rather than method-calling? But perhaps with more complete encapsulation? That's a step in the right direction perhaps, but I don't really see how it obviates the need for interfaces--you still need to know what messages a particular object can respond to, don't you?
Food and shelter would probably be a higher priority than smart phones, surely?

And I'm not sure 100,000 people is enough. You need the right people in the right place at the right time.
I can't speak for the PE side, but VCs aren't investing their own money. They have limited partners (LPs) that provide the money, and expect returns on it. This LP money goes into funds (vehicles to make investments out of). Each fund has a limited lifespan (the company I work for has fund lifetimes of around 8-10 years). This means that all of the money should be returned to investors over that time period. Since VCs can't make all of their investments at the beginning of the fund (for many reasons, chief among them scarcity) they need to show returns in an even shorter timeframe.

The bootstrapped founder, on the other hand, doesn't necessarily need to exit the investment in those 8-10 (or shorter) years. There are, of course, serial entrepreneurs for whom that is their goal, and for them (as the article points out) their incentives are aligned. For "lifestyle company" founders (not meant to be disparaging), an exit may not be necessary at all. The key differences are time horizon and exit.
The Mozilla Foundation owns Mozilla Corporation, and each organization has its own Board of Directors.
If the people they are comparing to is giving flat rates, then if they get an APR they need to be able to convert one number to the other to understand which is cheapest. I suspect even most Western consumers who are used to credit would get that wrong a lot of the time.

The flat rate is horribly misleading if you are comparing the flat rate for a fixed period of loans with different repayment periods, which might be the case if relying on advertised rates intended to mislead. It's fine, on the other hand, if the potential borrower goes to lender A and B and requests a quote for a specific loan period.

But I agree with you that a quick lesson on APR and showing APR also would be great.
There was a whole movie about interns at Fog Creek.

https://www.youtube.com/watch?v=0NRL7YsXjSg

I admit it could have been edited a bit better (read: more interesting), but it was still fun to get a bit more of an inside view of a process like this.
Seems to have been fixed; I now see http://i.imgur.com/dQeC01W.png
The profits, because of decreased competition.

But by industry, I mean specialised payday loan providers. The volume was increasing already.
#1 paid app in Playstore, "Virus Shield", is a complete scam
Ask HN: I am spent and exhausted, I don't know what to do
Hello folks of HN

As pretty much the only source of info and help on burnout, I turn to you. It has been a year in this company and I am pretty exhausted. I keep going from one burnout to the other in the name of release cycles. The love for the product is gone. I try talking to folks about a change in terms of jobs and I have had a barrage of rejections. Google in the final round rejected me. Companies looking to hire their first PM dont want to talk beyond the initial phone call. It is not hopelessly depressing yet but is very soon going to be. Couple this with barbaric hours at the startup and I dont even know if there is light at the end of the tunnel. I have done all the sane things like reach out for feedback etc etc but I get the canned "Not a fit" because relevant domain experience/we found someone better.

So, HN, How did you guys/gals handle rejection? Happy to PM my resume and talk to folks if there are any takers.

For clarity, I am not a developer/SDET. I am a PM and based on these rejections, not a good one at that :)
If you are using a HSM your long-term authenticity key won't be in the memory space of the process with openssl inside it. So that should be OK.

However, everything else in that process (like, all the traffic you were hoping to protect) is basically toast.
Wow, that's awesome.

Speaking of fourier, you need to see this
http://en.m.wikipedia.org/wiki/File:Fourier_transform_time_a...
It really depends on what you want to do. If all you're interested in is presenting a static(-ish) web page with some "extra" interaction, then sure.

If you want to do anything that harnesses the hardware or computing capability of the device, or anything more complicated the most basic HTML-based UI, then native apps are the way to go. This is independent of whether we're talking about mobile or desktop.
It should really be possible to easily detect what functionalities your deploy of OpenSSL is using and recompile only those.
I also did a project like this last year -- I only got around to asking for date & time working, and was happy enough to stop going there...

I disagree with (1), however: In the interest of making WAN-independent software (as in, I don't want my home automation to stop working if I can't call out to wit.ai), I actually don't agree with that point. I think that using CMUSphinx can be made extremely accurate with continuous training (something I'm angling to put in my version).

Then again, I'm planning on making a competing product so differentiation is good for me. I think there are a lot of ways they can improve on the idea
apt-get update && apt-get -t testing install openssl yields OpenSSL 1.0.1f on Debian sigh
Here's the commit for the fix: http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=...
Oh that's uber innovative.
There is literally nothing innovative about AirBnB or Uber. It's just "The Hilton App" or "The Checkered Cabs App", except that they break hotel & taxi law respectively
Oh. Sigh.
It does take time for these things to be tested and deployed. Regardless of severity of bug, distributions must test packages before sending them out to all their users.

It would be unfortunate if a new package were to be released immediately only to be soon masked/recalled due to unforeseen consequences.

Of note, the Gentoo package was bumped approximately 2 hours after the advisory was published.
Based upon the thoughtless drivel that I see spewed across Twitter, I don't see how it could be considered political activism of any sort. It takes no effort and no risk to shout something on Twitter.
For what it's worth...the read/unread sync state has been fixed recently in the last few months. With that also came the ability to IM someone who is offline and have them be able to read the IM even if when they come back online, you're offline (wow!! what sort of black magic is that??)
Is there anything else you could modify to change what the raft does?
I have been using Tonx for about a year and it has been awesome. Hopefully this doesn't change much about the service.
In essence, it's just recursion that's only allowed when the recursive input is in some sense strictly "smaller" than its input and therefore necessarily terminates if the input is of finite size and cannot drop below zero.

However, it's not magic: it's not automatically trivial to generate such a proof of termination (I'd assume there exist definitely terminating programs for any given proof system that cannot be proven to terminate in that formalism), and it may be a moot point since a slow enough algorithm is for all intents and purposes non-terminating...
gentoo has a flag for the TLS heartbeat, so its easy to turn off.

root# USE='-tls-heartbeat' emerge openssl
If you can't modify it, make a new one.
I doubt it. NPV is a kind of weird thing to be measuring though in personal lending. I guess in some cases it could be a "repair your car so you can get to work" situation. More likely it's to pay rent or eat or buy weed.
hey dgarrett this is nate from saleae. we offered 33% student discounts and which we've put on hold for the preorders. the discount was intended to drop the price on Logic >$100 to make it more affordable for students.

that being said, we've added a $99 product with the student community in mind. we will most likely resume the student discount program after launch when preorders are shipped.