skysight-inc/HackerNews huggingface dataset:
What popular SSL client software uses the vulnerable OpenSSL? (Any web browsers, for example on popular linuxes? How about 'curl' when connecting to HTTPS sites?)
Not that I went to anything approaching an Ivy League school, but I understand why they limited their search to that subset. They are more likely to find good matches, and given the low amount of time they probably allocated to this, it wouldn't make sense to canvas hundreds of universities.

I doubt that they met all of their applications at the Job fairs, and even if they did, it appears that Fog Creek also attended the SBU CS Fair (which is decidedly not an Ivy League).
Developers/publishers will likely opt-in to allow upload, similar to how Twitch streaming is opt-in.
There's a world of difference between, at one end, taking VC that puts you on a rocket ride of "get rich or die"; or, at the other end, not taking any money at all so that you cannot hire even 1 engineer to help you making the essential backup service into something that's one bus away from losing all my data.
My So-Called Enterprise Life
I would say their pricing models are much more dynamic, but that's because they're just middle men and aren't responsible for the supply side (except providing incentives to increase supply, not actually providing capital, management, etc).
http://journals.aps.org/prx/pdf/10.1103/PhysRevX.4.011026
Worse, it's retroactively unfixable: Even doing all this [revoking certs, new secret keys, new certificates] will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption.

So it would be a good idea to change all your passwords to critical services like email and banks, once they have issued new certs and updated their openssl.
In other words, vote with your feet. I get it. The idea being, if the government notices (and cares) that it's losing smart, productive, tax-paying (I assume) citizens then the government will have an incentive to do something (hopefully, something good) about it.

This is one of the reasons for the mass exodus away from certain US states and into others. People vote with their feet, and eventually policies catch up due to consequences.
I'm not entirely sure that as a patient in one of these hospitals, I'd appreciate the (white) girl with a camera strapped to her forehead walking through the place.

Trading patient privacy for donations seems like a worse deal than needs to be made here.
Tried putting the rss feed in feedly, but the entries don't link to pages on the site :(
Cant speak for the specifics but thats not what is happening.

What is happening is that the only jobs that are left are either STEM jobs or low paid jobs (Walmart etc)

The middle class is slowly destroyed because it's either been automated away, outsourced or at least can be done with a fraction of the people it used to involve.
Holy shit. That seems worse than the debian openssl debacle.

If i got that right ALL openssl private keys are now potentially compromised.

I hope vendors push fixes soon, and then I guess I'm busy for a few days regenerating private keys.
> I've learned over the years that some of these folks really truly believe this -- that they are making the world^Wweb a better place by displaying more ads in more places.

As Upton Sinclair (http://en.wikipedia.org/wiki/Upton_Sinclair) used to say, "It is difficult to get a man to understand something, when his salary depends upon his not understanding it."
Well said! The social world is a tricky one. And you just seem great so I'd love to get you a free copy of my book before its released next week if you want - just shoot me an email at kcrawford.msw@gmail.com
I knew I was going to be attacked for saying this, but isn't it a real possibility? We already know that they tried to weaken RSA.
I wonder if people already have gotten a head start on becoming ad-blind to these types of ads...
Have you seen http://kill-or-cure.herokuapp.com/ ?

I think you might get a kick out of it.
Open your phone and take note of the apps it has installed on it. How many of those apps are basics CRUD wrappers? Phones will only continue to get faster but these types of apps will stop pushing the envelope at some point. There's only so many fancy transparent swiping swooshing crap you can add to an app before you start to detract from the experience. At some point, mobile web apps will be just as performing as most native apps (we may already be there) at which point people will start to balk at the ridiculousness of having to write 3+ versions of the same damn CRUD app
Are there any Internship opportunities?
TLDR:
"Im an audiophool. I know whats great by the price stick^^^I could totally pick Strad blindfolded, I just didnt feel like it that day."
I don't know much about VC, but these sorts of claims are always surprising to me. Is it really moonshots or bust when you raise a VC round?

Even with a 2x liquidity preference, don't you just need to double the invested amount in order to have personally broken even on the VC deal?

Say you have a $10M business (pre-money), and you raise $5m at a 2x liquidity preference, giving up 50% of the company in the process. That would leave you with a $15M post-money valuation. So long as you can use that $5M to turn you from a $15M business into a $20M business, didn't you just break even on the deal?

I'm know it's not an outcome that the VC is looking for, but it would seem to be a fine outcome from the founder's perspective.
Key Data About 404 Errors
Given the severity of this bug, the UX of the site is failing anyone who isn't a fulltime sysadmin.

Suggestion: big, bold TLDR ("The sky is falling. Check your OpenSSL version right now") with a link on what to do sorted by OS vendor.

Step 1:
Here's a command to spit out your OpenSSL version. If it is the following string, go to step 2.

Step 2:
Here's how to update your OpenSSL. Here are links to guides on reissuing keys.

Probably OK the whole remediation bit links to a wiki that gets updated as the various vendors push their patches.
Should the priority on the ubuntu-security page be higher than "Medium"?
I'm really conflicted by this.

The good: Tonx is awesome. Blue Bottle is great. I can't imagine coffee quality will decline due to a merger.

The bad: Tonx has lost a lot of agility. Will great and potentially risky campaigns like the recent Starbucks campaign [0] still be possible with a retail infrastructure to support and worry about?

The ugly: Tonx brings to the table two amazing single origin roasts every single month. Blue Bottle seems to be focusing on expanding their digital presence with this deal [1] and at least in my experience, that is NOT what makes Tonx so fantastic.

It will be interesting to see where this goes.

[0]: https://tonx.org/better
[1]: http://blog.bluebottlecoffee.com/post/82020818086/welcome-ab...
Neither the timeline of Eich's donation nor the outcome of the prop 8 fight is relevant.

Such an absolute position would be reasonable if the action in question had some sort of permanent or destructive effect. It's entirely unreasonable to treat a political donation or a privately held political belief as if it were a crime with a permanent or perniciously destructive effect.

In other words, he has done nothing to assuage the suspicion that his personal convictions are in radical opposition to some of the most important cultural aims of the Mozilla organization.

I can understand this position as well. However, it seems dangerous for us to have a society where we have to be constantly be "saying the right things" or punitive actions are to be taken against us. This does not sound like a free society. Granted, as CEO of Mozilla, he is not in the same position as a typical private citizen, but the principles should still apply. "In radical opposition to some of the most important cultural aims" could just as well be rewritten as "Having political views we don't like."
Jews that went to Ivy League schools tend to hire other jews that go to Ivy League schools
Interesting observation. I was a member of Hacker Dojo but let my membership lapse because I simply wasn't going there often enough; I still do pop in a couple times a month to use it as a coworking space (paying for the $10/day wifi access, not the free one) but I can't quite tell what I get out of it.

Then again, I'm not sure what I expect to get out of it, nor what I really should be putting into it. There don't seem to be many opportunities to strike up conversations but it's possible (probable) I'm being too passive in seeking them out.
Object.defineProperty with 'writable' = false?
Yes and no.

First off, TLS is crypto bread-and-butter that's used for a lot more than HTTPS. You're not out of the woods because you're not running a webserver.

Second, SSH itself doesn't use TLS; it has its own protocol, so sshd isn't vulnerable.

But third, read overflows like this can be escalated in countless ways to total compromise if some credential, key, canary, or such gets leaked. So just because sshd isn't vulnerable doesn't mean you're not screwed.
On my CentOS boxes I ran 'yum list | grep openssl'
Yeah, similar experience here, but when every web browser (to some approximation) includes Javascript, you can hardly say that programming is inaccessible.

In most every possible way (except possibly writing files), Javascript simply wipes the floor with Basic.
This doesn't sound like "responsible disclosure" to me - how can Codenomicon dump this news when all the major Linux vendors don't have patches ready to go ?
Fog Creek actually does occasionally do co-op classes during the fall/spring, but there is rarely (never?) more than one at a time and we don't really advertise it.
Anybody up to visualizations about quaternions?
The biggest problem I see with this service is that exit code 0 does not guarantee the process successfully did what was intended (only that the process ended without errors). This solution seems to leave too many holes for false positives and false negatives to sneak through. When paying for services like this I want it to be bullet-proof rather than bullet-resistant.
I see no reason why it wouldn't catch up. What makes a good UI on a native app? Fast responses and clean animations? Fancy transparency and 3D effects, perhaps. There's no reason a web browser couldn't do these things. Web UIs may always be slower than native but with fast enough processors it will eventually reach a point where you just wont notice the difference.
This is perhaps somewhat misleading. It's possible that this bug was being actively exploited before now, so you should change your keys even if you use a CDN (all the majors have already fixed this as far as I'm aware).
says how to on the official notice: http://www.openssl.org/news/secadv_20140407.txt

recompile OpenSSL with -DOPENSSL_NO_HEARTBEATS
For those of us who run FreeBSD, there's gshsec(8):

http://www.freebsd.org/cgi/man.cgi?gshsec

Want to set up a "2 of 3" (or similar) scheme? You could use, for example, a three-disk RAID5 using USB flash drives.
I imagine the Watsi team (Grace in this case) has earned the respect and trust from both the hospital and patients to walk through with a camera like that.

In my limited experience visiting West Africa, there's rightful skepticism of expats but once you build trust they're very warm to you. The level of trust you have as a foreigner is sometimes higher than a local. My sister moved to Burkina Faso a year ago. She's not white (Indian) and no one there knows she's a doctor since she doesn't have her license yet. The locals trust her medical advice based entirely on the fact that she's an expat.

I'm not sure how different Kenya is from West Africa and realize the Watsi team was only there for a couple weeks but I think the same applies considering their comittment to the area.
The Arch package is available in Testing. https://www.archlinux.org/packages/testing/i686/openssl/
Agreed. They should reorder their headings, first should be What is it? and second should be How to stop it?
The second method listed is effectively the same as the U/AIS system that ships use[0]. The "U" stands for "Universal", from which we can deduce that actually only about 60% of ships actually use it.

The technology already exists, it just needs to be mandated for aircraft.

[0] http://en.wikipedia.org/wiki/Automatic_Identification_System
I suppose it depends on how you define "computer scientist". Nevertheless, i believe even that will be automated eventually.
For one thing, you'd have to trust the people that you pool with by quite a stretch.
There is absolutely no context around this post what so ever. I'm going to ask the obvious here; So what exactly "was" Living for Monday?
> if you're betting that 1/10 of your investments are returning your fund, then just one miss is the difference between a good year and "I don't have a VC firm anymore"

To add to this, the top 10 VC firms make up around 85% of all of the returns of VC firms combined, and the top 15 VC firms make up around 95%. (don't quote me on those specific numbers, but I believe they are roughly accurate based on a report from a16z).

Long story short - very very few VC funds see worthwhile returns. The one's that do are absolutely killing it.
an integrated applications suite = bunch of software interfaces for...

of comprehensive enterprise resource planning software = your business purchasing and maintenance problems

that combines business value = giving you the most bang for your buck,

standards-based technology = not sure about this one... can be tweaked by your IT department OR helps you select products/services that meet regulatory standards so that you won't get sued for cutting corners

deep industry experience = nobody got fired for picking something everyone uses

into a business solution = we will unpack and assemble it for you, but you should really buy the Gold Support Package or budget a lot more for your IT department, because it isn't compatible with anything else

with a low total cost of ownership = we make most of our money on the Gold Support Package, but will let you fool yourself into thinking that you won't need it.
Blue Bottle -> Broom in Harry Potter (GOF, advertisement at world cup)

Tonx -> Harry Potter character
There's a very big difference between trying to outlaw something the assumed victim does not want to be part of, e.g. murder, theft etc., vs. something the assumed victim is engaging in voluntarily, though we might suspect "forced" by circumstance, or by lack of knowledge etc.

As much as there are many things that it is easy to think "should" be illegal, outlawing the latter rarely works, not least because the assumed victim is likely not to want to cooperate with you, and potentially being outright hostile because they see a ban as being what is victimising them, rather than the provider of the banned service.

I don't think it's defeatist to accept this - it just means another angle is needed that the presumed victim will actually agree is beneficial to them, such as providing free financial advice, or mandating better information about actual loan costs. This is the approach taken to payday loans in the UK.

It doesn't stop the people who has a genuine need for cash even if it is expensive, doesn't drive them into the hand of hardened criminals, but hopefully helps to minimize demand. And improved labelling helps providers that can provide more competitive rates as well - at least one UK pawnbroker explicitly targets payday loan providers with their advertising by pointing to the lower rates they can provide, for example.
welp. it's 100% dead now.

Sorry about that. That's what you get for making something really interesting and posting about it on hacker news.
Ahh Borland! We used to use Borland C++ in high school (back in the late 90's).
No, I'd rather make up my own mind, and find my own ways to find the things I like.

I also like knowing what is going on in the world in general, not just in the niche of what I already know and am. What a concept! And for example "I wonder what is #1 on [search engine] for [random word]" is a question that cannot be answered meaningfully in a fully personalized web.

I imagine it would be a huge boon for the psyops crowd (includes marketing if you ask me) though: what better setup to fuck with people, than when no two people ever see the same? And skinner boxes also are much more effective when you don't see what is happening in other boxes I'm sure.
9 Development Practices To Write More Manageable and Efficient JS and jQuery
This should be interesting - especially with all the delivery startups which were created following uber's success.
Agreed. Check out this attempt with the Sencha Touch Framework from a couple years ago: http://www.sencha.com/blog/the-making-of-fastbook-an-html5-l...
Israeli startup shows off smartphone battery that charges in 30 seconds
Great article, and a topic much discussed in my family and friends social group. The situation will get worse, with some of us having it easy while more and more people are falling through the cracks.

For the shamefull people who have little empathy for people who more of less have done the right things in their lives but struggle anyway, I say to you: congratulations for becoming corporate shills or shills for the elite.

I especially liked the last paragraph in the article about lending a hand.
I agree. The beauty of Tonx is that it's all about the coffee itself. No milk, no sugar, no dilution. Blue Bottle seems more about the coffee drink and less about the coffee
Thanks for pointing that out, I actually have used Max/MSP and think it's awesome, it didn't even occur to me.
I had to make do with Einstein. I also discovered afterwards you can copy and paste images directly into DrRacket and pass them round like anything else - you might (very big guess) be able to create the wave and rogers primitives this way.
US burns through all high-skill visas for 2015 in less than a week
I am wanting to get this running on my BBB black. Hopefully it won't be that hard. It looks like mostly Python code, and a mountain of dependencies.
What concerns me (and I'm sure many others who don't like the idea of a larger iPhone) is that the iPhone 5s is currently the only flagship phone under 4.5". Sure, you can get smaller budget smartphones, but if you want a small high-end phone, it's Apple or nothing.

If the rumors are true and Apple decides to make the iPhone 6 4.7" and 5.5", what do I get next time I'm ready for an upgrade? I think it's silly for Apple to leave money on the table by only selling the current form factor when there's obviously a lot of demand for a larger iPhone, but it's equally silly to ignore the market for smaller phones like every other smartphone manufacturer is.
If you have a CS degree and you live in Silicon Valley changes are pretty much that you're one of the best educated people, in the richest country in the world at the place with one of the hottest economies of the moment. I would bet that you had to work really hard to be unemployable.

I would bet that a lot of people with CS degrees in Greece, Portugal or Spain have a very different story to tell.
The lynchpin is Office. Microsoft realizes that Windows is no longer ascendant. It's a post-PC world. But Office, thanks in part to Microsoft's efforts is successfully sabotaging the ISO standards decisions (OOXML vs. OpenDocument), is still a near-requirement - you at least need to be able to open .doc and .xls files.

I still expect Microsoft will treat Windows as "first among equals" similar to how Google treats Chrome for enhanced web features (not unlike how Apple did with Safari), but it's no longer going to be Windows-only.

Microsoft is showing a lot of clue lately. I would not count them out.
Until you get into the board meeting and realize you don't get to just do whatever you want to do while telling everyone what is best. If you go cowboy, you better make sure it 100% pays off, otherwise your time to failure is going to be quite short. At best you don't get more funding, at worst you get yourself blacklisted.
> JS running on the main thread absolutely is a problem, and Web Workers are a clunky solution.

Chrome is moving towards out-of-process iframes, which should help alleviate many performance issues (ads janking your page) and give you new capability (basically web workers with a full DOM).
http://www.chromium.org/developers/design-documents/oop-ifra...
I just did a apt-get update and apt-get upgrade and I saw upgrades for openssh-client and openssh-server.
I think you have a third party OpenSSL installed. On an unmodified 10.9.2 you get:

$ sw_vers
ProductName:	Mac OS X
ProductVersion:	10.9.2
BuildVersion:	13C64
$ openssl version
OpenSSL 0.9.8y 5 Feb 2013
It is a vulnerability in your environment if you're using some of these tools and your keys are in them. It is not a vulnerability of AWS itself.
Basically, it's UDID all over again, only worse.
How I taught my 3, 5 and 7 year old kids about variables
OpenSSH != OpenSSL. Those upgrades are for a different vulnerability in OpenSSH.
The linked article http://www.usatoday.com/story/money/personalfinance/2013/07/... is from last July. It mentions that recent CS grads had an unemployment rate of <9%. Recent drama and theater grads were only at 6%. This seems to be a new phenomenon, within the past year or so.
Awesome! Why didn't someone think of this years ago?!
Skilled manual labor (mechanics, electricans) are today still in high demand. At least where I live. It's unskilled labor that is disappearing in highly developed countries. I guess to a certain extent you can group skilled mmechanics with STEM....
Phantom 2 Vision Plus Drone [video] | High Tech Point
Unless you installed the macports version, which is 1.0.1f
Not really relevant the link between the two being from the same fictional world... gave me a chuckle.

http://harrypotter.wikia.com/wiki/Bluebottle

http://harrypotter.wikia.com/wiki/Nymphadora_Tonks
Ask HN: SEO snapshot services, for JavaScript heavy sites (AngularJS)
We are looking at few services that create SEO friendly snapshots of web pages (think JavaScript heavy site). I was wondering if anyone experience using any of the following (or have recommendations)

https://ajaxsnapshots.com/

http://www.brombone.com/

https://prerender.io/

http://getseojs.com/
1.0.1e-2+deb7u5	appearing now on security.debian.org.
I love this game! Such a cool idea, and very well executed.

My biggest critique so far is that it's extremely hard for me to tell the difference between #311 and #000 for the `.disabled` lines (I'm mildly red-green colorblind). Changing it to #711 fixed it for me, but I can imagine it would be impossible to even see #F11 for certain colorblind individuals. Perhaps some other kind of indication that a line is editable, or a more drastic #FFF/#000 distinction?
I just went to page for lenders to donate / lend 50$ to a guy in Kenya. First you say this:

> You can propose any interest rate between 5% and 30%. The first 5% goes to Zidisha to cover money transfer fees, and anything above that goes to lenders.

but then, on the next page you say that I need to pay 1.75$ for money transfer fees. What is the problem there? Why do I have to pay this fee multiple times? Will I also be charged that fee again when people start paying off?

Look, the idea of microfinancing is nice, but the way you play with the numbers in order for them to "look better" is just to scammy. In the end of the day, I just can't trust you anymore that the money really goes where you says it goes if you can't come up with the clear upfront cost breakout without playing games. If you are not playing games, but simply not understand how this looks like, then please just shut down and stop poisoning the good idea with atrocious presentations.
How so? A computer needs to be told what to do. That by definition is called programming.
https://davenport.geek.nz/bitcoin-day-7/
Can I send my kids to daycare through this?

How is it different to existing courier services - just has a better consumer reach, or will it be cheaper/available where couriers are not today? Are they disrupting any existing regulation? Is my stuff insured when they take it? Can i track the courier on a GPS?