skysight-inc/HackerNews huggingface dataset:
That's kind of missing the point though. It would be relatively easy to define an interface that is simple to use and allows implementing 90% of the use cases with rather low danger of shooting yourself in the foot. We know that this is possible because there are libraries out there that do it.

This whole thread is about OpenSSL somehow failing to do that, despite being called out on it for years.
And at least in the US, it would likely violate a federal law that has disproportionately stiff prison sentences.
Android 4.3+ adoption is barely over 10%, while iOS support must be in the 90% range.

EDIT: actually 14.2% [1].

on "x% of 1 billion is a lot": it's still way less than 90% of 500m devices, and you're still frustrating the majority of your user base.

[1] http://developer.android.com/about/dashboards/index.html
I'm really curious about this, because frankly I just do not care about food.

It costs a lot of money to buy. It costs a lot of time to prepare, unless you pay someone else even more money to do it for you. It takes up a ton of space, and even requires you to have a bunch of appliances just for its existence.

All so you can what- get a taste in your mouth and not die? I know that's a gross oversimplification(forgive me for it if you will), but it's always been a hassle I just really don't enjoy dealing with as often as I have to. I want to enjoy food, not be forced into it.

If this is actually healthy- and I want something more than a few people living off of it for a couple weeks- I'd love it. I wouldn't give up food entirely of course, but I'd save it for when I actually want a specific taste, or to go to a specific experience with friends and family.
Your site (blogspot's site?) breaks my back button something fierce.
Mr. Macintosh
> [1] You do seem to talk about them like they are animals

Few people choose to use IE6 of their own free will. Most IE6 users are stuck with IE6 because a large bureaucracy told them to do so. And when talking about large bureaucracies, I find it entirely appropriate to talk in terms of positive and negative incentives and reinforcements because that's the language they understand the best.

And I agree with you that, in some sense, we really haven't changed much in the last 10-20 years. There's been massive quantitative improvement, but that doesn't necessarily translate to qualitative changes.
This whole thing was totally mismanaged.

Cloudflare had 1 week's notice from these codenomicon guys, and they patched it and stayed silent (NDA?).

Then the codenomicon came up with a fancy name, bought a domain that I'm guessing they paid a fair sum for (for publicity?) and publicized it without notifying anyone (Amazon? Yahoo?, any Linux distro?)

I mean, openssl.org's own website was vulnerable until not too long ago.

I don't appreciate having to build custom RPMs in the middle of the night because my distribution had no prior warning.

I really don't appreciate this spectacle to advertise a security services firm.
I find this to be another instance of "That's not quite what happened" when comparing a Mother Jones headline and the article.
Plus, who doesn't want a subdomain at crabdance.com?
haha! mind you i am an asian, it took me to search whole world wide web to find the meaning of this phrase!

And! yes consider yourself dead ;)
You are wrong, racists are wrong, therefore you are a racist.

QED.

(The classic racist comparison is "black people are monkeys". This comparison is "the code is awful, as if it were written by non-sentient animals bashing on keyboards". This comparison has nothing to do with race, it's not suggesting any particular race wrote OpenSSL or that any particular race cannot write good code or good cryptography systems. It is not making any distinction by race at all.

If they described it as "OpenSSL was written by crashing ink tankers into alphabeti-spaghetti lorries" would that be racially comparing people with vehicles?)
No doubt, but how would you get it approved by the university ethics board?
I met Mike and Scott in 2004 and they were incredibly humble, focused and benevolent then. From what I can tell they seem to have maintained that through the years and all their success. They also had a President of their company names Jeffery Walker, who was one of the kindest and most interesting guys I've ever met.

This is a company that is learning too. Since the acquisition of HipChat they have made the product dramatically better. If they can get a good model in place for further acquisitions, and they can continue to successfully launch their own products as well as they have in the last few years, then this company is on track to being worth a hell of a lot more than $3.3bn.
This is why I disagree with many things PHK says. Like you, he pays a great deal of attention to how he wishes things had turned out, instead of figuring out how to make what we have better.

Get browsers to act in the way you want, then we'll talk. Until then, people using self-signed certificates are causing active harm now.
Depending on how deep we go, we could end up throwing everything away, the CA infrastructure, the cipher suite flexibility, the vast quantities of knowledge that surround the OpenSSL ecosystem and allow thousands of developers to work in a more secure manner than would otherwise be possible.

I want to cover the cipher suite flexibility quickly, just to point out how much of a fantastic idea it is. The server and client tell each other what their most-prefered ciphers are, then they agree on the strongest one that they both support.

This has massive benefits, for instance, when BEAST et. al. came along and effectively broke block cipher based OpenSSL for a while, we could jump to RC4 for a little while. When that was broke, we all hauled ass back to AES. This gives incredibly flexibility when dealing with many attacks, by simply being able to circumvent the affected parts.

This is frustrating.

All three of the major ciphersuite problems in SSL/TLS (BEAST, RC4, Lucky13) were well-known in the literature prior to their discovery.

The BEAST vulnerability --- chaining IVs across messages instead of making them explicit and thus unpredictable --- was described years before BEAST was published, and was presaged by Phil Rogaway in discussions about IPSEC.

It is possible that RC4 was known to be vulnerable all the way from the moment it was leaked to Usenet. Certainly, the statistical biases were well-known. Not just apocryphally, but in the academic literature.

Lucky13 was a product of MAC-then-encrypt constructions, and an instance of a specific attack Vaudenay described in the early 2000s.

TLS has "ciphersuite flexibility" that has enabled the protocol to hop from one vulnerability to another. Meanwhile, fundamental fixes (either explicit encrypt-then-MAC, or AEAD modes like GCM, or secure native stream ciphers) have demanded fundamental protocol changes, not just new entries in a list of ciphersuites.
There are other billionaires, and he's an embarrassment to Stanford (although not as much of one as Lucas Duplan for Clinkle). They could've done better with that slot.
The last time I picked up a $10 BT dongle, it had "CSR 4.0" written on it but was neither CSR (Cambridge Silicon Radio) or 4.0. Any hints?
IM CRYING! SO AMAZING! _______________
C != OpenSSL. Some [1] would argue OpenSSL is not representative at all what C can do. Maybe you should check out Redis for beauty [2] and joy [3].

On the same note C != C++ either and you can write large systems in C++ without ever using memory allocation. You can use only bounds checked functions.

And you can have large security holes if you're not careful, no matter which language you pick.

[1] http://news.ycombinator.com/item?id=7556407

[2] http://johnpwood.net/2012/07/18/the-beauty-of-redis/

[3] http://news.ycombinator.com/item?id=2275413
article was sensationalistic (not shocking out of motherjones) and erroneous. please don't turn HN into reddit.
I've stuck to Swedish layout but I've remapped all of `{}[]()\ in fact! :-)
> During his time as congressman from 1997 to 2009, Cannon voted for a constitutional amendment banning same-sex marriage, against a ban on sexual-orientation based job discrimination, and for prohibition of gay adoptions.

The Congressman Cannon took a strong anti-gay stance & supported legislation allowing job discrimination against homosexuals. The title seems accurate.

> However, a contribution made to a candidate with views on hundreds of issues

Obviously the rights of homosexuals was not that important to Yagan.
18 year old entrepreneur on Instagram
I remember a rather similar DOS game with an ASCII display (and probably a decade younger in coding) that was a turn-based fleet battle between whichever two sides (of Federation, Klingon, Romulan, or Orion) and relative ship numbers per side you liked. For some reason, the executable was called "begin.exe".

Pity I lost track of the disk.
Hah, I'd be glad if my router used SSL. If anyone wants to fire up binwalk and run it over a few router firmwares, it'd make for an interesting blog post.
I don't trust this stuff. The plural of anecdote is not data, and a couple people who've tried this are not a representative indication of whether this is safe or not.

Diet is still not well understood, and current science, IMO, is too soft of a foundation upon which to build a complete meal replacement on. I'm sure this would be fine for the occasional use, but until some longitudinal studies are performed, I would be weary for long term usage.
"Unfortunately this site is only available from Great Britain."

Do you have another link? This looks interesting.
Page speed does have an impact on Google rankings. You should care about the speed of your site not just because of your Google rankings, but because it makes a huge difference to your user experience.

That's the hazard of this site. In summarizing to 1-2 words, some of the nuance is lost.
I did read it, after it was helpfully posted elsewhere. I wish I hadn't. Not surprisingly, it wasn't worth my time.
Every time with the "I don't really understand ...".

It pops up everywhere; It's ubiquitous. You always have someone saying "I don't understand why this is so popular when it was done before". "I don't understand why you would do this when this also works and is already available".

With tech, with everything. Heck, even on HN/Reddit! When there's a repost with a catchier title, people don't understand how the old submission didn't get more upvooootes!

People don't understand Docker when BSD Jails are the thing!

People don't understand why Das Keyboards are so popular when the Model M is clearly better!

People don't understand why Apple is getting all the love for products that are "basically just a shinier x and y".

Maybe you guys should think for a minute and then you'll understand. I'm tired of this trope.

Because marketing
Yes it does. It's just not enabled by default.
Donating to a congressman who took a strong anti-gay stance is hardly the same as "donating to an anti-gay campaign".
Workday (NYSE:WDAY) was founded in 2005 and floated in 2012 with the valuation of $4.5B (currently $15B). However the Workday story is different because it was started by grownups and well geared towards enterprise from the start (business model, marketing, connection, financing, etc).
What's are the best alternatives?

I've recently started looking, and PolarSSL[0] and Botan[1] are on my trial list. Mozilla NSS looks a little low level, and GnuTLS hasn't faired much better lately, despite having much better code hygiene than OpenSSL.

[0] https://polarssl.org/
[1] http://botan.randombit.net/
I switch shirts every 5-6 videos, and we go down the list of videos in order of votes, so shirt color is mostly uncorrelated with the content. If I'm doing a longer or more in-depth video, then I might pick a specific shirt that goes with the topic.
If there's something more to Tumblr, I wouldn't know, and there is no reason to assume I would.

"This guy says something I associate with racism so he's racist. I say something you associate with Tumblr and there's NO REASON TO ASSUME I KNOW ANYTHING ABOUT TUMBLR".

nknighthb, meet double standards. Double standards, nknighthb.
Right, is it really any "harder"? If we assume rational and consistent grading of applicants (I know, I know, but we have to make some assumptions) then if you're in, say, the top 3%, is it actually any hard to get in? Are the new applicants for any given school actually good or are they simply optimistic students who didn't apply before?

I mean, how many people who Harvard (say) would accept don't already apply? Probably a pretty small number. The issue with getting into Harvard remains a number of factors, but other applicants in't really one of them. That is, the quality of the applicant pool of people accepted hasn't changed much.
How many people are going to check that box under "Advanced Settings"? 0.1%?
> In the modern American cultural context, monkeys are associated with bananas.

Actually, code monkeys are associated with Fritos.
Does this work? http://www.justproxy.co.uk/index.php?q=aHR0cHM6Ly93d3cuZXZpZ...
Congratulations to Atlassian. We've been using a locally-hosted Confluence instance for over 3 years in a higher education setting and it's been a great experience. The more I use Confluence, the more I see it's true value as a collaboration platform. The uptake among users has been great and the sharing of information has grown exponentially. The product consistently improves and gets easier to use over time as opposed to typical enterprise applications.
Everybody wants prior warning, but very early in the process you hit a point where secret notices create more harm than help.

The worst situation you can be in is where everyone knows something is going on, but only a small group of people know what it is. At that point, the incentives strongly favor the attackers, who will work quickly to join the in-crowd and exploit the window of time where they know how to exploit the flaw, and site operators don't know enough about it to take it seriously.

It's especially hard to stage-manage these updates with open source software. Look at the patch; to someone who takes exploit code seriously, the vulnerability is instantly obvious. How was anyone supposed to give you a heads up without tipping off attackers?
I don't understand. What part of TLS are you calling "simple"?
Interactive Census profile for San Francisco
Current versions of Firefox also do not use CRL, if I understand correctly. It seems most modern browsers prefer OCSP instead, with CRL only as a fallback or not at all. You can find some of the rationale at these links:

https://mail.mozilla.org/pipermail/firefox-dev/2013-April/00...

https://mail.mozilla.org/pipermail/firefox-dev/2013-May/0003...

https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...

https://wiki.mozilla.org/CA:ImprovingRevocation
Řrřola (a famous demoscene coder [1]) found a far better constant than the original (a 2.7-fold accuracy improvement) by using an optimisation algorithm over all three constants present in the original inverse square hack.

His algorithm and the result (along with a plot of relative error) can be found on his blog [2].

[1]: See, for example, this 256-byte raycaster https://www.youtube.com/watch?v=R35UuntQQF8

[2]: http://rrrola.wz.cz/inv_sqrt.html
> Yes, I chat with my friends in "sms" style Arabic on IM so to speak. Hmm, so you're saying Quranic Arabic is like sms style

No I'm saying that sms arabic is a transliteration or arabic into latin script, despite very different alphabets. Obviously it's possible. I find it fascinating, because there's actually multiple styles of doing this. But I like the version where they use numbers to complete the set of letters. Reminds me of old French texts that also have a "3"-shaped letter lost in the middle of words instead of the modern letter, and those were some of the first non-mother-tongue texts I read. Fairy tales. I think I'm getting old.

> Wrong again. Vowels ARE part of both languages.

In modern arabic, sort-of (spoken, yes, written, not really, same as in hebrew really, which is to say, not at all (say different vowels and people will still understand you), but yes you can put little marks on the letters now indicating which vowel to use in "most" cases. I was told this is mainly done for children's first reads though, and not done in normal handwritten texts). In ancient (written) arabic, it is never done.

Obviously the arabs living in the 8th century still used vowels, just not in writing.

As for Luxenberg's thesis, buy his book and read it. It has chapters full of those verses.

> The language of the Quran did play a role in converting people back when it was revealed, because it was unique -- yet still understandable.

Doesn't that just further confirm this situation though ? It's "unique", is that perhaps a polite way of saying that it's very different from anything else you've ever read, with "weird" verb forms, words with wrong roots and the like ?

I guess I don't fully understand what you're saying. Either it's "unique" arabic, or it's not, right. I'm thinking that what you're calling unique arabic would be more accurately identified as "not quite" arabic.
The geek guide to insurance: An attempt to change America’s most arcane industry
It's pretty similar. Actually, it's worse since the congressman is a lawmaker that can influence other lawmakers with his agenda & draft bills. Yagan is also rewarding the Cannon for his stance on the issues.
How would you like shuffles exposed? One of the things we really tried to do with this design is make sure it's NOT tied to one particular hardware implementation of SIMD.
Hahaha, so true...
Given that a 4-year degree costs from $40K to $100K with all the costs, it's pretty trivial to spend $1K on applications.

And application fees are probably self-funding. I doubt there's any incentive for schools to try to limit the number of applicants.
> you might want to install a gem like Annotate

slaps head I was doing that by hand - lol.
One of the relevant issues here is that the top colleges have are essentially a better bet wrt prestige vs. other colleges. The fact that the college educated adult in the US is not as capable as the average college educated adult in a developed country world-wide (in OECD countries, see[1]) to me tells me how there is some truth to this perception. There is no denying that a physicist from Harvard is far above the average in the world, the problem is that if you're not from Harvard, statistics like these seem to imply that you aren't even prepared to be average. The problem here is that the Ivys suck up all the intelligent people and professors and the rest of us are left with less bright people (bright no doubt, but not "Ivy" material). Unless you can make it into the club, you won't be as prepared as your smarter and/or luckier peers.

The problem is that we in the US are doing fantastic in raising up the best of us (those who get into Harvard) but the average has obviously fucking languished. Personally, one way I think we can help at least somewhat is for government not to exclusively fund only these Ivys, but to cut off some for the rest of us (you know, judge research by its merit). Other than that, I'm at a loss for ideas

It wouldn't be too bad to not go to Harvard if the local state uni wasn't that much worse.

[1] http://www.oecd.org/statistics/datalab/skills-outlook.htm
this had a different name on commodore computers with graphics but same exact play and screens
The big four (?) banks in Australia seem to not be affected. I'm fairly sure they run IIS, anyway.
Unlikely to be that high. The 0.1% that may dig in those advanced settings is likely the same 0.1% that disabled the thing back when it was enabled by default. CRLs are worthless.
Who is requiring Soylent purchasers (or you) to eat it for every meal? I've never heard anyone even suggest that they're personally going to do that. It's getting tiresome seeing this comment posted over and over again.
Now the question is: could you arrive at this algorithm without previous knowledge of what it should converge to?
Security by diversity means that any extreme rare vulnerability will only hit a few individuals. The trade is that there will be more unique vulnerabilities found.

In risk management, having risk spread out is general a favored tactic. Same is true in biology. The chance that remote memory access vulnerability is so rare, that 200 libraries (if equally used) would lower the effected number of people with a factor of almost 200.
If we order now, will we still have ours shipped with the first batch? Or is it back logged?

I'm excited about this. I love eating food but I really hate making it. If this proves adequate I can definitely see myself having this 5-6 days a week and then eating meals on the weekend with humans.
This is pretty hard to do when your mentors have to answer letters of recommendation for each school :(

Many of them are questionnaires now, not just copy+paste.
The immutable design came from the class library folks (not my team [the JIT folks]). I believe the analogy to atomic types (integers aren't mutable) is pretty sound. The API really was cleaner by making them immutable. If you want to allow mutation, the API surface area really explodes, resulting in dramatically more JIT work to make them perform well.
Very nice. Maybe the best /. interview I've ever read. McAfee may be crazy (or not, I don't know) but he sure as heck is entertaining. I'd love to sit at a bar and drink with him sometime.
APPLE IWATCH'S LATEST UV EXPOSURE SENSOR ADDTION
You're right, I misworded. I should have said that I see no functional advantage to Soylent as it's already been done by many others already, and with more scientific evidence.

I would be more trusting of their product if they had worked with an established medical nutrition supplier to rebrand and flavour an existing enteral feed, rather than hacking something up and minimally testing it.
The Crossroads of Should and Must
Soylent is betting on the fact that consumers want to separate the nourishment of food from the ritual of eating. That's a bit like saying, "We can offer you the ability to reproduce without the inconvenience of having sex."

Don't get me wrong...I hope that this startup will succeed and prove me wrong. And to be fair, they aren't calling for people to abandon solid food. It's just that, as technical people, I think we sometimes overemphasize the efficiency of this product and underemphasize the cultural attitudes of everyday consumers.
Heartbleed Bug Response
Hide those ugly 'utm' strings from your users
Top 3 Core Exercises (Plus: Free Core Workout)
I've used figaro but recently switched off in favor of a combo of foreman, dotenv, and heroku-config[1].

- Foreman is great because you'll get parity with how Heroku runs things (they use the same Procfile and read a .env file). Plus, if you have separate workers, then you can easily boot up your app.

- Dotenv is drop-in for Rails and supports .env usage outside of foreman.

- The heroku-config plugin is great because it works throughout your system and can also pull down the current config from Heroku.

[1] https://github.com/ddollar/heroku-config
By law Chinese MMOs have to be hosted by Chinese companies.
On the flip side of the coin, there's ries, which takes a number and finds a mathematical expression that approximates it: http://mrob.com/pub/ries/
I have played ATS a Trek MUSH: telnet ats.trekmush.org 1701
Notes on Slack’s response to the Heartbleed vulnerability
Probably the best basic Angular Tutorial I have seen!
> If you extract code from C# to C, you don't need a GC or any of the .NET class libraries

The problem is, you do need them. There's no 1:1 C# -> C extraction. You have to extract at least some part of the CLR along with.
Mourinho's Chelsea do it while Ancelotti almost blows it again
In response to all those animations and JS: Best Fourier Transform in GIF
The whole Eich scandal was also sensationalistic. That's the problem with being judgmental. Often times the judgmental people are being hypocritical.