skysight-inc/HackerNews huggingface dataset:
a vocal, nonviolent nonmajority speaking out online. If you think that doesn't sound like a free society, I think you may not very familiar with what actual non-free societies look like.

Everything is contextual, and you are right, that in a broader context, all of the people discussed, Brendan Eich included, have it pretty good in the global scheme of things.

However, non-free societies look like this:

You are expected to hew to certain viewpoints. It is not enough for you to just be quiet, you have to actively and enthusiastically say and write words supporting the "right" opinion. If you have ever expressed the "wrong" opinion in the past, then this is enough to bring punitive action against you, regardless of the current circumstances, though you might win redemption if you make a loud and public declaration of contrition. Only the expression of a "wrong" opinion is enough for punishment -- no concrete act is required, only the apparent possibility of it. The historical fact of your actual behavior is irrelevant to the above.

As an exercise, the reader can come up with their own examples for groups and governments that enacted behaviors and policies like the above. By doing so, even in a smaller context, one actively promotes social dynamics that inhibit open and free dissent and exchange of ideas. (Also note, that the previous paragraph applies just as well to how men were expected to express their status as heterosexual.)

Political power is always contextual, as is the human social behavior on which it is based. If you are in a context where you have power, and someone is telling you something you don't like to hear, well guess what: Someone is speaking truth to power, and it isn't you. (At least, in their own POV. It's this whole problem of POV and the unreasonable position of adjudicator of correct speech that underlies the notion of free speech.)
Not to sound like a commercial for Cloudflare or anything. But putting your infrastructure behind their services can protect users while they perform their patching. According to their latest blog post http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerab...
"Before the Raspberry Pi, there were Linux-capable ARM Dev Boards, but the vast majority of them were niche items, over $150... Now, there's a proliferation of sub-$100 Linux-capable boards..."

If anything started this it was the BeagleBoard released by TI well before the Pi. You can get a feel for how much influence it had from the fact that half the boards released these days are named *Board in a similar way. MinnowBoard, CubieBoard, DragonBoard, OwlBoard, MarsBoard, Arndale Board, PandaBoard, CosmicBoard... I could go on...

I'm no Raspberry Pi hater, but let's just not go all history-revisionism here.
One obvious - if slightly paranoid - answer is that this was a deliberate backdoor. There appears to be a length field specific to the heartbeat packet that's used to determine how much data from the original packet is included in the response, isn't checked against the actual packet length, and allows lengths up to 64k which is unnecessarily generous for the intended purpose but very useful for this attack.
How does that use the diagonal argument? If the diagonal argument could be used it would be to prove that the number of submarine routes isn't countable.

Edit: just looked at the SVG called "Diagonal Argument.svg". That's not what I know as the diagonal argument (https://en.wikipedia.org/wiki/Cantor%27s_diagonal_argument, http://mathworld.wolfram.com/CantorDiagonalMethod.html)
Yeah, it's really surprising to me since I had both my Mom and my sister independently recommend Cover to me.

I would put money on Cover being a WhatsApp success story in 3yrs. Oh well, there must have been some internal issues we don't know about.

Hope someone steps up quickly to fill the gap!
Google was interested in my company. They hired everyone but me (her)
It was very useful for me to be able to go right from the lockscreen to the app i wanted without the intermediary step of going to the launcher.

It was also very useful how i could just drag a bit on an icon and get a peek of what the app is doing.

It was also useful how from any screen I could drag from the upper-right and get a sort of alt-tab list of recent apps that involved less tapping around than hitting the Android multitasking button and then which running app i wanted.
Mine was on the 48k Spectrum, a lovely machine, even though the BASIC was a little non-standard, and I had to work out how to change listings in magazines to work on it!

My progression went: Spectrum BASIC, Z80 assembler, x86 assembler, C, Java .. more.
If that would work Virtual Machines and runtimes wouldn't have vulnerabilities.

So uhm. Yeah, that doesn't work either.

Edit: Btw since HN has this obessions with Tarsnap, it's written in C btw. So you should stop obessing about it and downvote me some more.
#1 Paid App in Google Play Store is a scam
+1 iOS.
The local government puts taxes on hotels to get money from visitors who don't have a vote. In some cases they put regulations on hotels that limit competition or make them more expensive to operate. Then they have regulations that limit the production of new housing, artificially raising the price by preventing the supply from growing. Then they have to implement rent control to control the damage caused by that, which horribly harms the market as well.

And then all anyone complains about is how their neighbor is doing something they don't like with their own home.
See, not trying to bignote myself, but I've kinda gone through a "saving the world" phase. Not like the Silicon valley people. As in I took a job working with the unemployed, then I moved jobs to work for a group that works with and advocates for the homeless. Both have left me incredibly jaded. I thought I could go in with my gifts and do something for people. I couldn't, not really, and discovered charities and the like are full of self-interested/damaged people and politics much like anywhere else.

I know exactly what you're talking about with the startup culture: "Saving the world with an advertising/smart-phone-app/messaging service". Every time Zuckerberg opens his mouth I wonder whether he believes or has thought about what he's saying, whether he's just saying it to use investor money to achieve his own ends, or whether he's just saying it to try to placate the public/silicon valley/himself. Which, look, I guess you just have to laugh at it. But i also guess that not buying into the workplace culture makes such places awkward to work at.

I'm currently facing new moral dilemmas. Looking to move on again, but I'm seriously considering some of the grey areas I'd written off before (say working for big banks), primarily for the money. I reason if they can use me in a fraud analysis or something, maybe I could live with myself. Anyway, thanks for the opportunity to think about such things :P
Telegram and The Future of Mobile Messaging
I can confirm this for vanilla Ubuntu 12.04 LTS. I've been checking for the past hour. The updates for the following just appeared:

Setting up libssl-doc (1.0.1-4ubuntu5.12) ...
Setting up libssl-dev (1.0.1-4ubuntu5.12) ...
Setting up openssl (1.0.1-4ubuntu5.12) ...
Or the laws are still good ideas, but startups "move fast and break things" as an excuse to circumvent the laws for their own growth and profit. I'm sure companies ignoring the law to increase profits is also incredibly shocking.
The one saving grace about automation is that there
Is rarely enough time to automate everything. The automation software will need to be tweaked to manage the infinite variability of the future.

I think getting rid of, or reducing payroll, tax is a good idea in the medium term though.
For the record, I have no trouble at all believing that it works that way for many people. The claim was that this is how it works for everyone, and that I find questionable - in my experience, some people work better verbally than visually. I'm pretty good visually, but it definitely feels like I'm engaging different systems when I am reasoning using words than when I am reasoning using images - and I don't expect this generalizes.
D3.js example block search
I wouldn't say a lot.
level 35! https://gist.github.com/anonymous/25b4b4b56f844368a37c here's to calling into the code behind using pattern matching and the nifty in operator
Google Licenses Room 77 Software in Mobile Travel-Booking Push
Really nicely implemented
The Dunning-Kruger Effect Effect.
Αποφραξεις αθηνα – apofraxeis-vlachos.gr
I am going to respectfully disagree. Just because the company can do it doesn't mean a weekend is plenty. You are given a weekend to decide where you might spend months of your life, potentially in a place you've never been. On top of that, who knows if that weekend was going to be extremely busy for you? Just because you take one week to decide on an offer doesn't mean you don't want to be there. It's also not at all an industry standard to give such a short timespan for the decision; if anything, it's a reflection of how little the company will care about the intern when he/she is there.

All in all, a weekend is certainly not "plenty". I sympathize with crazypyro.
This is a pretty spammy link.
Cover didn't really have customers - their app was "beta" and was free. I don't know that they had any servers or anything is stored online, you don't create an account to use the app. The type of pledge you're advocating wouldn't really make a difference for this app, but I can see where it could be useful in other cases.
Why doesn't Watsi open source its code so developers can donate their time?
Windows XP End of Support is tomorrow (April 8th)
Not an office manager, but I know an executive assistant who was making $4-500K before she retired, working for a Fortune 100 CEO. She was incredibly effective but hated the stress of the job, so she kept quitting and the CEO kept raising her pay until she eventually couldn't take it anymore.
I suppose it will be big surprise to many people (even some russians) to know, that first capital of ancient Russia was Kiev, current capital of Ukraine ;)
It's obviously a reference to "Neue Helvetica", and that is the font's name, not "Helvetica Neue", as too many people seem to believe. Just wanted to point that out.
USA opposes 'Schengen cloud' Eurocentric routing plan
That's so baffling. A while back I used...I think it was Timbuk2's backpack/messenger bag customization interface, which is fantastic for actually designing/ordering a product and has a "share" button, but it inexplicably only lets you share to Facebook. (And maybe Twitter and G+, I forget.) They actually generate a URL, don't let you see it, but will put it on Facebook for you.

I cannot comprehend what sort of thought leads to an implementation like that.
From a quick reading of the TLS heartbeat RFC and the patched code, here's my understanding of the cause of the bug.

TLS heartbeat consists of a request packet including a payload; the other side reads and sends a response containing the same payload (plus some other padding).

In the code that handles TLS heartbeat requests, the payload size is read from the packet controlled by the attacker:

n2s(p, payload);
pl = p;

Here, p is a pointer to the request packet, and payload is the expected length of the payload (read as a 16-bit short integer: this is the origin of the 64K limit per request).

pl is the pointer to the actual payload in the request packet.

Then the response packet is constructed:

/* Enter response type, length and copy payload */
*bp++ = TLS1_HB_RESPONSE;
s2n(payload, bp);
memcpy(bp, pl, payload);

The payload length is stored into the destination packet, and then the payload is copied from the source packet pl to the destination packet bp.

The bug is that the payload length is never actually checked against the size of the request packet. Therefore, the memcpy() can read arbitrary data beyond the storage location of the request by sending an arbitrary payload length (up to 64K) and an undersized payload.

I find it hard to believe that the OpenSSL code does not have any better abstraction for handling streams of bytes; if the packets were represented as a (pointer, length) pair with simple wrapper functions to copy from one stream to another, this bug could have been avoided. C makes this sort of bug easy to write, but careful API design would make it much harder to do by accident.
This is no longer true – they're opt-in. And by invitation only.
Amazon Dash may change grocery shopping
"If not universal, I'd say geometric interpretations were at least pretty widespread."

I'd have had no objection to that. Clearly, many people do learn visually and clearly many people are good at manipulating mental imagery. Support them! Just be careful you're not ignoring those that don't (or at least know that that's what you're doing). If you're going to make a case that there are no such people (or a negligible number) then that needs support.

The story here about imagination seems highly relevant (along with the broader point): http://lesswrong.com/lw/dr/generalizing_from_one_example
Not everyone lives in SF bubble
Google was interested in buying my 5 person company for our team
Hi modernm,

I see what you mean. This is confusing because our website is programmed to display the registration fee only for applicants who have not yet had a loan disbursed. Once a loan is disbursed, the fee is paid and is no longer displayed in the loan profile page as part of the amount due to be paid by the borrower.

The second and subsequent loans contain a link "View previous loans" under the "On-Time Repayments" record in the right panel. All the loans that do not have that link are first loans.
Well, I'm not really in position of taking the whole service down at this moment, I would really like to have a way to patch it instead.
That's why I have high hopes for Rust. We really need to move away from C for critical infrastructure. Perhaps C++ as well, though the latter does have more ways to mitigate certain memory issues.

Incidentally, someone on the mailing list brought up the issue of having a compiler flag to disable bounds checking. However, the Rust authors were strictly against it.
I think you're confusing the Ellis Act with the SF Rent Ordinance, which establishes rent control and other things. The Ellis Act is generally considered to be hostile to tenants and friendly to landlords (as it sets up a sort of loophole to evict rent-controlled tenants).
Related: things like these do not work, because of implementation.

if (false) // <- inserted by me
for (var ...) { // <- existing code
...code...
}

Too bad, because extra `for`s could be fun...
GitHub sexism investigation failing
There was a pretty good writeup on that. Short answer: Mobile devices.
True, though I would hope most services don't have public facing bitcoind instances to begin with...
they did not try to "weaken RSA", as in the RSA algorithm. They paid off and/or infiltrated RSA the corporation. You were not attacked, your posts simply contained wrong information and useless speculation.

Screaming about the NSA every time a security bug comes up is not interesting, productive, insightful, or useful, please stop.
Functional VPLs have the same abstraction/scaling up problems as OO VPLs. The problem is that we (as human beings) don't know how to communicate very efficiently without our words, and visual embellishment is not directly useful.
This argument came up in the thread from a few years ago. It is quite wrong-headed. I would like to give a clear answer to it:

Virtual machines and runtimes may be vulnerable to malicious CODE. That's bad. Programs written in unmanaged languages are vulnerable to malicious DATA. That's horrible and unmitigatable.

Vulns to malicious code are bad, but they may be mitigated by not running untrusted code (hard, but doable in contexts of high security). They are also mitigated by the fact that the runtime or VM is a small piece of code which may even be amenable to formal verification.

Vulns to malicious data, or malicious connection patterns, are impossible to avoid. You can't accept only trusted data in anything user-facing. Also, these vulnerabilities are spread through billions of lines of application and OS code, as opposed to core runtime/VM.
In keeping with the tradition of bad car analogies, that's like saying "Driving cars with automatic traction control won't make accidents go away, so automatic traction control is pointless".

Languages with bounds checks on array accesses don't solve everything, but that doesn't mean that they don't work. They do remove entire classes of silent failures that can potentially slip through the cracks in C-like languages. VMs aren't needed for this -- most of the strongly typed functional languages, D, Go, Rust, and others all compile down to native machine code.

Careful API design, discipline, and good coding in C can also mitigate this sort of problem manually, although (like most things in C), it's extra work, and needs careful thought to ensure correctness.
Same, just looking at the job listings in my city there are hundreds of open CS related jobs. Some pretty interesting too, one company hiring for Scheme/Lisp hackers who want to make their own DSL's.
There is no end to suffering, only a redefinition of suffering relative to our notion of pleasure.
"Total computing power" is massively load-dependent. And I don't think The VideoCore IV is massively outstanding in the field of embedded GPUs.

Links? This is turning into a let-me-google-that-for-you, but they appear very regularly on http://linuxgizmos.com
Ownership means a few things, it's the right to use, and the right to deny use of, and if someone opposes you on your rightful usage or denial, then the unlimited fury of a thousand policemen are available to correct the other person.

You said the HOA doesn't own anything, actually they do "literally own" a portion of the thing that people pay for when buying a house. The right to deny use of your property for subletting (like airbnb). And if you don't comply, the policemen hit you with sticks until you do.

You said the HOA doesn't own anything, they own you, the human unit living in the home via dues. They also own a guarantee of income to whatever human unit lives in that house, that is a higher quality item to own than having ownership of say a cat or car. and the fact that your home serves as security for whatever liabilities the HOA corp board chooses to incur, HOA-burdened property represents a liability rather than an asset. It's a secondary level of government that resembles a banana republic.

There is also a continuing misperception that HOA corporations are miniature democracies. They are not. They have none of the protections for individual rights. So what if 50% of the neighbors don't like something. Majority rule might be fine for setting pool hours for the HOA corp's pool, but majority rule is not a democracy and it is not appropriate for what happens between the bedroom walls of "your" or more specifically "their" home.

The disputes that develop over the propriety and interpretation of restrictions is another cesspool. If there were no HOA corp, the disputes would tend to simply be differences of opinion. Natural barriers to litigation include the cost of litigation and the uncertainty of the outcome. However, the board members of an HOA corp bear no personal responsibility for financing litigation and are driven as much to harm fellow residents as they are to win. If they can cost a homeowner $20,000 and up, then their egos are satiated even if their HOA corp loses. The management companies profit from accusations of violations. The HOA attorney is likewise more concerned about provoking and maintaining the dispute for profit.

Which is why HOA's lower property values significantly by lowering the pool of available buyers.
I commented on this elsewhere in this thread:

> This is no longer true – they're opt-in. And by invitation only.
They really should call them "indentured servant slave visas". The H1-B visa holder has to leave the country if he gets fired (and doesn't find a new employer quickly), and if he switches jobs the green card process has to start over.

Because the H1-B visa employee is legally bound to the job, he becomes more attractive than hiring a US citizen, (assuming equal salary and qualification).
The most annoying thing about internships are smug comments like this about interns.
function FT(A, N, φ) {
φ = φ || 0;
return function(x) {
var n = -1, y = 0;
while (++n < N) {
y += A[n] * Math.sin(τ * (n + 1) * x + φ);
}
return y;
}
}

hehe, seems annoying to type. Copy&paste everytime one of them is needed?
http://acko.net/blog/animate-your-way-to-glory-pt2/

Check out under "Blowing up the Death Star". You'll need a decent graphic card that works well with WebGL though.
On the difficulty of thinking big
Well someone was able to give Cloudflare a heads up last week [1].

It would have been nice if the package maintainers could have had time to build ready-to-roll solutions with Heartbeat compiled out prior to the official OpenSSL fix.

[1] http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerab...
Facebook buy Secret?
VMs generally do not have this type of vulnerability (buffer overrun).

Also, most vulnerabilities in (e.g.) the JVM can only be exploited by running malicious code inside the VM. Here, the attacker is supplying data used by OpenSSL, but is not able to supply arbitrary code.
Depending on the distro on which you're based, you may find that making a new package from a source package (e.g. srpm) would be the safest route even if you're in a hurry.

If you're on Ubuntu, it would appear at least the updated base (OpenSSL itself) packages are now in the repos.

http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...
IOS BDD Tutorial – Part 1: The Paradigm Shift
I like it. There should also be a "delete" feature in addition to notification. Sort of a self-destruct dropbox (in the generic sense) to contain your most private and personal data -- bits you want to "take to the grave" with you, so to speak. They only exist there for as long as you respond to the ping, otherwise they're deleted. Maybe it's already thought about by the creators, but it's not apparent in the description. My $0.02
Kids feel, Sony has wiped their effort on school
Kids worked hard on school to get grades for PS3 game, got the wrong download (PS Vita). Called Sony but they offer no solution.

Be careful before buying stuff on the PS Network. No refunds, no solutions.

Kids did learn a valuable lesson, corporations will happily take their money if they make a mistake.

My doubt, should I let them learn the hard lesson, or should I just pretend nothing happened and buy another copy of the game for the correct console.

So far I've told them they made a mistake and Sony just took their money.

All the work they put on school to get good grades has been wiped out by a silly mistake on their part and no will from Sony to help fix it.
i recently saw a table of firms awarded these visas. it seemed nuts to me that a large proportion of the visas go to firms whose primary business line is outsourcing in one form or another.

i typically think of visas as fulfilling unmet hiring needs for domestic US firms - like Facebook! - but instead see they are largely squirreled away by firms whose primary function is overseas labor cost arbitrage.

I would be interested to hear informed opinions as to why so many visas go to these firms. i thought the stated objective is to help american firms meet their hiring needs where the local work force is deficient.

instead, it seems like all the demand is corralled into a few firms which do the dirty work for everyone else. if your primary purpose is outsourcing, how can you plausibly claim to be searching for qualified workers inside the US, and thus deserving of access to these visas?
>Harder to do that now.

My bank account agrees with you.