skysight-inc/HackerNews huggingface dataset:
How did Cloudflare get access to this bug a week before it was made public, yet no distro has a package ready?

How's that for responsible disclosure?
How about opening some large GPU instances and mine some btc ;)
PMS COP – Horror Movie
After being caught on camera brutally beating a clown rapist, police officer Mary Collins is informed by her commanding officer that she needs counseling.

Her therapist quickly concludes that she suffers from extreme PMS and enrolls her in a drug trial for the new menstrual wonder drug Corybantic.

Mary responds positively until a devastating incident throws her into a monstrous drug-induced killing frenzy. Soon everyone who comes into contact with the PMS cop realizes it IS her time of the month.
Update to 1.0.1g, redo all crypto. That is, revoke certs and keys and regenerate.
Not only HTTPS. Many other protocols are TLS-based: modern email, some VPNs, etc. Really almost everything secret on the Internet is protected by TLS; SSH is a rare exception.
Thanks for the links. The big thing heartbleed.com is missing is what to do!
OpenSSL didn't notify Ubuntu about Heartbleed
That's an amazing idea. What would it take?
First, a little context goes a long way. Read the article. It talks about design in the context of how things LOOK and feel NOT in the context of programming design/design patterns.
Second, Just because someone who uses an application doesn't give a shit about how it is implemented does NOT mean implementation doesn't matter. You can have the slickest interface with the coolest animations but if it's not implemented correctly you can have security leaks, compromised data and in some cases absolutely NOTHING [1] behind your so called "the only thing matters" Interface.
[1]http://www.androidpolice.com/2014/04/06/the-1-new-paid-app-i...
> If Eich were running around being a dick to gay Mozilla employees, nobody would disagree with firing him. But he's not.

Not in public, no. However, he was a dick to them in private where he though it'd be safe. Prop 8 was about taking away a right that gay people had. They were already allowed to marry. This was about the majority ganging up on a small, persecuted group and taking things away from them by legislative fiat. The Constitution forbids this, as was later confirmed by the courts.

If Prop 8 had been about re-enslaving blacks, and he'd donated to that, do you think we'd be saying, "well, but he's nice to all the black people he works with!" It was morally repugnant to support Prop 8, and public acts like political donations do, shockingly, have consequences.
In NYC where parking is scarce, bikes and runners make more sense than cars for the kind of service we're looking to offer.
I just don't know if Python will actually be better after the tools are there. What R does is good what python will eventually be is good but not necessarily better.
That's not all bad though, assuming you are successful enough to be pulling in an equivalent salary to what you could make elsewhere.
The point is to build a product and sell it to a giant? ok, then.
Why don't they just put more light fibers in there while they're at it, as they're small and cheap?
> Just one little extra bit of functionality, and ... whoops! Suddenly, you can program there, so now you will have to program there.

That's an argument for programming languages in configuration, not against. It's just that we need good languages there, so that if you "have to program there" it's not a painstaking experience.

Designing a programming language is hard. Really, really hard. Or rather it's extremely easy to make completely unusable language, especially if it wasn't designed as a language from the start. You don't want to do this to your users and to yourself.

You either just don't include a programmable configuration, which is a fine tradeoff, or you include a "real" language from the start. For scripting languages it's easy, just use themselves. For compiled languages it's even easier: just use Lua or Scheme and be done with it.

But please, whatever you do, don't invent your own configuration (what's wrong with standard "key = value" format anyway?) format and if you do DON'T try to gradually extend it into a language. It will be hideous, unusable, insecure, unreadable, impossible to debug, buggy like hell and will haunt you forever in nightmares.

That being said, don't be afraid to experiment and try to build a language if you want. Just don't force it on others in production environment until you're sure it's not as described above :)
Maybe the quality of your sleep is the issue?

EDIT: OK, a lot of people talking about that below.
Seriously.

Let me say up front that I have a strong dislike for marketing and sales people. They surprise me sometimes, though.

FTA:

> "If we can complement the experience people already enjoy using Disqus ..."

> "So instead, they’re pinned to the top of the discussion environment where things are just getting started. It’s like movie previews. It’s not the thing you came for, but if done well, it adds a little bit to your experience ..."

I've learned over the years that some of these folks really truly believe this -- that they are making the world^Wweb a better place by displaying more ads in more places.

I don't remember the last time I left a comment on a site that uses Disqus but, seriously, who the "enjoy[s] using Disqus"? It's just not something that you "enjoy" doing, although the marketing/P.R. people would seem to believe that you do.
> It assumes native apps are standing still, when in fact they are moving rapidly forward. If anything, the gap continues to grow.

I'm sorry, but there are only so many ways you can display a CRUD application. I don't see the next versions of Twitter and Instagram pushing the hardware much more than they are today..
Do you call everyone that don't share your view of gay marriage an "enemy"? I bet you have friends that don't share this view.

There are decent people who have old school views. They are just slow to adjust due to upbringing or religion.
So, basically people were just against what he might do. (Which also has clear parallels with past justifications for firing a gay CEO.)
Any chance this bug originated with the NSA? It seems like it would fall under their goal of subverting the infrastructure that keeps secrets on the internet. Of course this is exactly why such a goal is a bad idea - an unprotected internet causes widespread damage.
Agreed. This is also going to be its undoing. While I don't anticipate a sudden consumer rebellion against provider lock-in (not least since the market can remain irrational longer than you, qua the vendor of a better alternative, can remain solvent), I do think there is going to be a great clearing-out.
LiveFyre, IntenseDebate are the only two that have rough feature parity and they don't take money either.

I guess an opportunity for someone to go build one? ;)
I think what will happen is what happened on the desktop. There was a time when every application you wanted on the desktop had to be installed natively. This was because of the following reasons: web didn't exist yet, web existed but the tools sucked, web existed but networks were slow. Over time the networks got fast enough and the tools got good enough that the vast majority of applications could be built as a website. There are still cases where building a desktop application makes sense such as when performance is critical, but those cases are in the minority now. Building a website also has the distinct advantage that you only need to build it once and it works everywhere (mostly).

When it comes to mobile, I think we are in the "web exists and the tools are almost good enough but the networks suck" phase. When the mobile networks get fast enough, I suspect most applications will just be websites. Of course there will always be some applications that are built for native because of performance or they have some fancy touch-based interaction.
UBER TO Launch UBERRUSH, ITS NYC COURIER SERVICE
sshd implements the SSH protocol, not the TLS protocol.
Enterprise mode for IE11
I would not be surprised if they scoop up and acquire Postmates in the next 12-18 months.
cached: http://webcache.googleusercontent.com/search?q=cache:Fk-RAMh...

And text:

People are spending more time on mobile vs desktop:

And more of their mobile time using apps, not the web:

This is a worrisome trend for the web. Mobile is the future. What wins mobile, wins the Internet. Right now, apps are winning and the web is losing.

Moreover, there are signs that it will only get worse. Ask any web company and they will tell you that they value app users more than web users. This is why you see so many popups and banners on mobile websites that try to get you to download apps. It is also why so many mobile websites are broken. Resources are going to app development over web development. As the mobile web UX further deteriorates, the momentum toward apps will only increase.

The likely end state is the web becomes a niche product used for things like 1) trying a service before you download the app, 2) consuming long tail content (e.g. link to a niche blog from Twitter or Facebook feed).

This will hurt long-term innovation from a number of reasons:

1) Apps have a rich-get-richer dynamic that favors the status quo over new innovations. Popular apps get home screen placement, get used more, get ranked higher in app stores, make more money, can pay more for distribution, etc. The end state will probably be like cable TV – a few dominant channels/apps that sit on users’ home screens and everything else relegated to lower tiers or irrelevance.

2) Apps are heavily controlled by the dominant app stores owners, Apple and Google. Google and Apple control what apps are allowed to exist, how apps are built, what apps get promoted, and charge a 30% tax on revenues.

Most worrisome: they reject entire classes of apps without stated reasons or allowing for recourse (e.g. Apple has rejected all apps related to Bitcoin). The open architecture of the web led to an incredible era of experimentation. Many startups are controversial when they are first founded. What if AOL or some other central gatekeeper had controlled the web, and developers had to ask permission to create Google, Youtube, eBay, Paypal, Wikipedia, Twitter, Facebook, etc. Sadly, this is where we’re headed on mobile.
3 New Ideas For Finding Lost Planes
Can't they atleast hire one person that didn't luck out by being born in a rich/middle class american family to go to ivy league universities.

What is such complicated product that Fog Creek makes that it needs graduates from top 10 universities? Serious question.
>Apple routinely rejects applications to their App store. Have you not read any of the numerous stories where app devs get denied?

Yes, I am aware. And yes, you are right. But the gatekeeping on the app stores has nothing to do with the music, movie or even book industry. Could they be more lenient? Yes, but you can't denied that the game has indeed changed.

>I'm speculating of course, but real world anecdotes would lead me to believe that a very small % of the population even knows what an APK is.

I would say that you are right again. And you are also right, maybe this is a debate about freedom, but personally, I don't consider having to go to settings, security and checking a box, a large barrier to freedom. If you actually seek freedom, it's only a few (acceptable) steps away.
This thing has been in the wild for two years. What are the odds it hasn't been systematically abused? And what does this imply?

To me it sounds kind of like finding out the fence in your backyard was cut open two years ago. Except in this case the backyard is two thirds of the internet.
It was - registered 2 days ago by Marko Laakso from Codenomicon, the guys credited (by themselves it seems !) with finding the bug:

http://www.networksolutions.com/whois/results.jsp?domain=hea...
TLS is a protocol, OpenSSL is a library, sshd uses the latter to implement the SSH protocol.
I'm a current Tonx subscriber, and I bought Blue Bottle when you could only get it from that hole in the wall on Linden Lane.

But for some reason this announcement still feels like a loss to me. It's probably my aversion to all those SF people who rave about Blue Bottle, but get drinks that drown out the coffee flavor with milk and sugar.

But it'll probably work out for the best.
Oh yeah, I ignored this at first because I just saw wikipedia, but it's the same animation that was discussed in the other HN post.
I wrote a bash script to check the top 1000 websites and huge percentage of them responded with heartbeat extension (30-40%):

INPUT=websites.csv
OLDIFS=$IFS
IFS=,
[ ! -f $INPUT ] && { echo "$INPUT file not found"; exit 99; }
while read rank website
do
echo "checking $website for heartbeat..."
echo -e "quit\n" | /usr/local/bin/openssl s_client -connect $website:443 -tlsextdebug 2>&1| grep 'TLS server extension "heartbeat" (id=15), len=1'
done < $INPUT
IFS=$OLDIFS

You can download a list of top 1 million websites from Alexa and Quantcast: http://www.seobook.com/download-alexa-top-1-000-000-websites...

Chinese websites timeout on port 443 so you'll have to skip them.
Interesting. Blue Bottle already offers subscription coffee by mail. I believe it is cheaper than Tonx, and much better coffee in my humble opinion with the ability to choose your beans. I'm hoping the quality and pricing flows towards Blue Bottle instead of the other way around.
RRAM Takes on Flash
I heard an interesting explanation a while back ago about not seeking venture capital, and instead seeking an investor.

Investors are more committed and interested (by the explainer) to the entrepreneur instead of looking for deal flow and exits above all else (which I guess most VCs are more interested in)
I just went to m.trulia.com on firefox on android on HTC One 4GLTE and got sent to the "Download our free app" (in orange button). When I clicked on Continue to mobile Site at the top (green), The site was dirt slow loading photos of a bunch of homes.
(granted, my network sucks where I am... but that's the point: bad network)
On behalf of a student who just finished up the internship search: Companies/recruiters, please note the advice put forth here.

A couple of points I'd like to touch on:

* Be sure to provide your interns with a ton of guidance, and promote this in during your recruitment process. Many of my fellow students are turned off by the bigger companies since they feel like they won't be able to make an impact. As a smaller company, this is your ace in the hole. Use it to your advantage.

* Personally, exploding offers leave a bad taste in my mouth. Everyone knows how long the recruitment process takes, and you should give the intern the common courtesy to make an informed decision. The last thing you want is a disgruntled intern on your payroll for a few months.

* You should consider internships as an investment. Build a relationship with your intern, and it will pay numerous dividends in the long run. They might return for a full-time position or they may refer a friend that they respect. A good way to support your intern during the school year is to sponsor a hackathon or an interview workshop at their school. This gets you face-to-face with some of the most motivated hackers at any school, where you can begin the courting process.

Just some quick thoughts from the student's side of the table.
I think an internship in a top tier bank in London pays about 3000 pounds/month for a summer analyst and 5000 pounds/month. My data are outdated though, maybe the salaries have gone down after the crisis, but I doubt it and would rather think they decreased the number of interns.
I really think Xbox could win the battle for the living room.

I'm more excited for it as a media center than as a game console. The fact that they let you pass through your cable box to an HDMI-IN shows me that they have been paying attention. I believe this was something that the Logitech Revue pioneered but unfortunately didn't take off due to being too slow a unit. I've been waiting to see who might support this and so far it only looks like Microsoft has. You may not appreciate it, but being able to flip between games/sites/cable instantly goes a long way in making your living room experience seamless, and I really think that will be the difference in this short term (while people still own cable boxes) if Sony/Apple/Google don't follow suit.
Rare Nivana video from 1988
I think Facebook is an instructive example here. They tried for a long time to make their native app (for Android, anyway) just a wrapper over the mobile web client, but they could never get the performance all the way there. They went native and have seen great results. They resisted as long as they could but eventually the products had to diverge.

I'd say 80% of developers who choose native do so for performance, and 20% do it because the app store and home screen placement is better for branding and content discovery than just sticking up your website on a server somewhere.

I think there's room for some sort of hybrid product but I'm not sure what it would look like. Maybe a mobile browser with super-aggressive caching (like not even a HEAD request for JS and CSS) and the ability to improve performance for the foreground page to the point where it's near-native. I'd use that for the mobile websites that I use less frequently, and continue to download the native apps for the things I use every day.
Neither the timeline of Eich's donation nor the outcome of the prop 8 fight is relevant. Eich has given no indication that he feels differently now than he did then. In other words, he has done nothing to assuage the suspicion that his personal convictions are in radical opposition to some of the most important cultural aims of the Mozilla organization.

I'm sad for Mozilla because Eich is a great and rare talent.
No, Bitcoin doesn't use SSL/TLS.

It could have implications for Bitcoin web services that use HTTPS, of course.
It's not that far off the top tier pay for tech companies. Glassdoor compiled their list for 2014, and it's not too inaccurate [1]. Speaking from personal experience, the numbers for SWE undergrads for some of the companies on the list this year:

Palantir - 7,500 - 1,200 for housing if you choose

Facebook - 6,200 + free housing

Salesforce - Varies per year, 34.50/hr for rising junior, housing.

Cisco - 22/hr

Quora and Dropbox are both missing from this list but they both have higher salaries than Palantir, but not by too much.

[1] http://www.glassdoor.com/blog/25-highest-paying-companies-in...
I don't know a single computer scientist struggling for work. Infact the opposite it true.
> Unless users are able to respond to them and not have their comments hidden.

In the screenshots, there's a "Reply" button under the ad^W"Sponsored Comment". Want to take bets on how long it'll be until that goes away? I can see exactly what you described happening.
Reasons Why San Francisco is the Worst Place Ever
From what I understood, an attacker could get 64Kb chunks per one request.
I think startssl requires $$$$ to revoke and/or reissue those "free" certs before they expire :-/
This is disappointing, but not surprising. Sigh.
To be clear, the Gentoo package is only in unstable. It hasn't reached stable yet. (https://bugs.gentoo.org/show_bug.cgi?id=507074)
Lunar Armbands
My guess is that these folks have CS degrees but didn't actually learn anything or have any practical CS experience (open source etc.).
At my university, we get a lot of co-ops because of the engineering nature of majority of the students. I've found that engineering companies that make physical things are more likely to do co-ops and companies that focus on a completely coded product/companies that have a traditionally CS focus tend to do interns. Just my experience here though.
Facebook comes up a lot in these discussions and it's important to provide some context. Facebook's HTML5-first strategy pre-dated the launch of the original iPhone. In the first native mobile app they were simply rendering the mobile facebook site in a UIWebView. There are so many better ways to do HTML5 and HTML5/native hybrid apps these days. Check out the Basecamp app, for instance. It's every bit as good as Facebook's mobile app but it makes heavy use of HTML5.
I want to say that hacker groups haven’t declined, it’s just that now they don’t call themselves hacker groups, they call themselves startup companies.
The original article says:

Can attacker access only 64k of the memory?
There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed.

...so I guess the answer to 2 is only limited by how frequently you can change the heartbeat settings, and how frequently OpenSSL will send a heartbeat packet.
Neat! Then perhaps you can provide some insight into why Skype ditched peer-to-peer in favour of centralisation?
Explanation and analysis of the idea of a 'post-employment economy', i.e. increasing corporate profits and decreasing employment, is given in 'The Lights in the Tunnel' by Martin Ford (which I found to be a good read, although a little verbose).

The main argument is that cheap computerized automation is displacing human workers, and corporate incentives are such that the trend is likely to continue. The long-term problem is that if systemic unemployment grows then the economy as a whole starts to flag b/c consumers no longer have the funds to drive the consumer economy.

His solution is rethinking corporate tax (reducing/eliminating pay-roll taxes which discentivize hiring, and potentially increasing corporate revenue tax). If displacement becomes extreme, he suggests that corporate taxes could fund a basic income for displaced workers to prop up the consumer economy.
Works for the water as well. :]
This post does a great job of showing a simple truth that many people forget: when you genuinely help a person, you are also helping everyone in that person's "sphere". There is a kind of exponential echoing effect when you are good-to.
That is my concern as well. We are still running CentOS 6.4 which does not have the affected version of OpenSSL, but we terminate SSL at the ELB so if they are affected then are keys are not safe.

Edit: I've posted on the support forum, hopefully they get back to us https://forums.aws.amazon.com/thread.jspa?threadID=149690
I've been a Tonx subscriber for almost two years now... Not exactly sure how to feel about this, I hope it doesn't really change anything. I really enjoy their service, the coffee they send is always fantastic, and the quantity is perfect for my consumption patterns.

edit: I took a look at the Blue Bottle service just now. While the price point is half of what I pay for Tonx for the same subscription, it seems like you get the same bag every time? Part of the fun of Tonx is the fact that they send you stuff that they think is great from all over the world, and not just the same thing every two weeks.
It is up to your own interpretation, but my intention was more the former. If all 89 voices say the same thing, then not only do those voices lose some credibility and a key opportunity to share their opinion, but the users lose the diversity of opinion that they were after.

I highly doubt that the 89 domains that people visit in a month each cover different topics. I'd bet that there is a high cross-over and the user is visiting them to read about what they have to say on a topic.
There were a number of epic one-liners similar to the above. If anyone is interested in the phenomenon, you can read our book 10 PRINT CHR$(205.5+RND(1));:GOTO 10 which we give away free at [1] and has LOTS and LOTS of details about the history of BASIC.

[1] http://10print.org/
I doublechecked and didn't see any mention of a one-time registration fee on any of those 20 loans?

I'll go back and look at the 20 loans with your tip in mind, and recalculate APRs separately for both first-time borrowers and repeat borrowers, and update the post.