skysight-inc/HackerNews huggingface dataset:
> http://hackage.haskell.org/package/securemem implements constant-time bytestring comparisons for haskell. With the bonus that the data is scrubbed when GC'd.

As far as I understand, this is not sufficient.

Some things that are needed in addition are (at least):

* constant time math operations (multiply, divide, exponentiation, etc.)

* no branching based on secrets (running the code results in no branch conditions based on secret data)

Here's an interesting article on implementing a form of Elliptic Curve Cryptography without even local timing attacks: http://blog.cr.yp.to/20140323-ecdsa.html
Looks like that file was pulled. Here's a mirror on Pastebin:

http://pastebin.com/YsdUXL1F
> In order to attack an HTTPS connection, the attacker has to have MITM position against the victim: the ability to intercept TCP connections.

> Such an attacker can obviously also block the CRL/OCSP lookup if one is made.

This is not at all obvious to me. Suppose you wanted to steal credit cards. The best place to do your MITM would be at the payment processor's connection to the net.

The clients doing the CRL/OSCP lookup will be connecting to the certificate authority, not the payment processor, for this. The MITM won't see them in most cases.

People who do their MITM close to the client can probably stop CRL/OSCP lookup, of course.
I thought Rust was old hat? Haven't we all moved on to Node.js? Or it was Grep ou Gulp or something.

I find it hard to keep up.
If you like this kind of thing, try to find copies of books by Dave Ahl - see http://en.wikipedia.org/wiki/BASIC_Computer_Games

I like this kind of thing and I have both books. A family friend CP/M system was by first gaming experience and I played all of them. The Star Trek here exists in a sort of copyright limbo, CBS obviously didn't license it but it was too popular to squash. I remember seeing ports of this to Amiga, Palm Pilot and Windows CE over the years.

Colossal Cave is a contemporary - it wasn't distributed as source (to my recollection... compiled OBASIC.COM IIRC?) so it isn't in the books but it was my favourite.
Compare order of magnitude for register access versus cache versus RAM versus HDD.

With page files, all of those are treated the same by the programmer.

Local HDD can already have access latency similar to the local network!

It is another order of magnitude to go beyond that. Meh.

Reliability is, IMHO, the bigger issue.
US Air Force takes a look through Google Glass
dang, as per the HN guidelines, I always try and submit with the title of the page I'm submitting...even if it's link baity. Is that still the desired guideline or should we do something else?
TLS implementation in Go. http://golang.org/pkg/crypto/tls/

Go is probably better at this.
I've just been learning about OSv from Cloudius Systems. More than just a single address space they have a single process (intended to run as a KVM guest). It makes some interesting optimizations possible and they get some incredible results: memcached, unmodified, runs faster in their KVM guest than it does on the bare metal. It seems limiting at first, but for the right use case their approach is really worth a look.
You're conflating intelligence with money-making ability. Solid intelligence helps for sure, and it's probably even true that, all things being equal, intelligence is monotonically related to money-making ability. But all other things are not equal, and there are other things necessary for money-making. In particular, colleges will look for kids with unusually high ambition, people skills, conscientiousness, leadership, etc. It can make sense to sacrifice the very far tail of the IQ bell curve in order to fish out still-very-smart people who are strong in those other necessary ways.

Again, I suggest you look into twin studies if you want to see the evidence that class per se is not particularly important. But I'm not going to discuss that here.
Cenqua is the company that had fishey, crucible & clover. About 5 people when they bought it, and probably their first acquisition.
> I don't want to share pictures with a million people anymore, just my family and really close friends.

You've just described the typical use-case for what most people use FB for. I don't think FB was ever about sharing with a million people, just whoever you friended.
Become a MakeGamesWithUs (YC W12) Campus Rep
We're looking for college students to drive applications for our Summer Academy. Info on what the job entails: http://www.mgw.us/reps

How to Apply

Instead of providing your resume, give us a sense of your background, relevant past experience, why you would be right for this position, and some ideas you have on how you would drive applications for the Summer Academy. Be concise. Email your info to ashu@makegameswith.us

About MakeGamesWithUs

MakeGamesWithUs teaches students to design and code iPhone games. Students can learn through free online tutorials, or participate in our Summer Academy where they will ship their own original game to the App Store. Our curriculum is used to teach courses at 3 of the top 4 universities for computer engineering. Over 250 students have taken our in-person courses and nearly a million students have used our online tutorials. We were founded in 2012 and are funded by Y Combinator, Andreessen Horowitz, Alexis Ohanian, Tim Draper and more.
Actually, I can see managed services companies eating these up, High priority ticket comes in? Flashing red light in the support room.
First VR Headset with a 2.5K Display
Still, having that setting there means you can easily tell people to turn it on...
Chrome: Rollit
I'd guess Neel hasn't put anything on his resume for about the last decade.

My company worked hard on recruiting him about that long ago and his reputation was already well established then.
Chicago Crime Rates
The first thing I searched for in the README was "constant time".

This whole thing has got me curious about techniques for formally verifying software.

I'm a complete beginner on this topic, but I assume there are tools to help write software that's formally verified / proven to be correct. Can they make any guarantees about side-channel aspects such as timing in these systems? Anyone care to give me some pointers on where to begin?
I really like this snippet from the justification for the symbol chosen: "APL apparently used +.×, which by combining a multi-character token, confusing attribute-access-like . syntax, and a unicode character, ranks somewhere below U+2603 SNOWMAN on our candidate list".

One of the reasons I have been such a fan of Python for so long is the relatively no-nonsense approach to design decisions that many others would have rushed through.
The other side of the market reportedly works much more efficient. Tons of middlemen sourcing the latest 0days and paying more the higher to the top of the pyramid they get.
CXXNET: A Deep Conv NN with 1000 lines core code 
CXXNET is yet another implementation of (convolutional) neural network. It is in C++, with about 1000 lines of network layer implementations, it is able to train ImageNet in fast speed.
Just realised I accidentally deleted a line while I was reformatting, that should read:

0x18 TLS content type: heartbeat [*]
0x03 0x02 protocol version: TLS 1.1 [RFC 4346, section A.1]
0x00 0x03 content length: 3 bytes [RFC 4346, section A.1]
0x01 message type: heartbeat request [RFC 6520, section 3]
0x40 0x00 payload length: 16384 bytes [RFC 6520, section 4]
I have 767 friends, mainly from the "hacker scene", YC and startups, Iraq/Afghanistan, diving, shooting sports, and cypherpunks.

I have my FB set to "friends only", so I can make posts which can't be linked from Google results or elsewhere. Generally, anything which is either less-general-interest or more-sensitive than twitter, but which I want to post in general, vs. to a specific crowd. (Even more public/reputational than twitter would be HN submissions; HN comments generally are on-topic, and more on par with Twitter for sensitivity, although down in a conversation not as generally relevant.)

I also have a few "secret fb groups" where we discuss various things.

None of this really requires extreme privacy; it's just "please don't quote this in public yet" or "this might be too boring for the public."

Since I've curated my friends well, I tend to see pretty interesting debates about:
1) guns (which is fun because especially the UK friends are anti-guns, and others are in the industry, and it remains civil)

2) crypto, security, and hardware stuff (including my own startup)

3) political issues (generally "good governance" which tends toward non-partisan, but also generally libertarian stuff)

4) major world events (e.g. I have friends from Ukraine, and when Afghanistan stories come up, I have friends I worked with in Afghanistan, and some who are in Afghanistan now)

FB Messenger isn't secure/is archived by FB for unknown future use, but is remarkably convenient. If nothing else, it is better for "presence" than any of the encrypted chat stuff I use for content, so either non-sensitive discussions there, or "can we talk on OTR/irc/etc.?"

It's also still my favorite photo sharing site for photos restricted to friends. My workflow involves Lightroom and then publishing to Flickr (public), FB (friends), 500px (pro). (although my real workflow is "archive to a drive and sit on them until I have time to edit...I have about a year backlog right now).

I don't use Dropbox or WhatsApp.
Users, like the author of this blog, benefit from a secure SSL implementation as well: it makes sure our data is secure. How much has the author voluntarily paid to the person who discovered the bug?

It's quite easy -- and probably completely ineffective -- to come out and say someone should pay this man one million dollars. In my opinion, it's a lot more helpful to shell out some money yourself, at least if you think other people are obligated to do so.

I don't mean to say that this guy should just "shut up and pay up" -- not at all. My point is that it's often a lot more effective to, when something needs to be done, do 1% of what needs to be done, instead of asking "other people" to do 100% of it. If we all do the latter, nothing gets done, and if only 100 people do the former, it's done.
StoreDot Demo Video: Recharges Battery in 30 seconds
Handheld Nintendo 64 – Controller Style v2.0
great posts here. marking it for later
It really depends on whether you have an "open" friending policy or not, and if you have family/work friends/etc. who deter real sharing. And then whether you share to public, friends of friends, friends, or subgroups. Doing all this per-post is probably more work than I'd be willing to deal with, so I just set it as "friends", and add people who are interesting on my friends own posts to my fl.

LiveJournal (RIP) is what trained me in all this behavior.
If Frere-Jones loses the lawsuit, he should just release his own versions of Gotham, Whitney, etc. After all, in the United States, typefaces are not subject to copyright [1]. There is legal precedent that provides protection for font files, (i.e. the "software" that generates the fonts) but the designs themselves cannot be copyrighted. Just consider the many variants of Helvetica or Futura [2], each published by a different foundry.

If Frere-Jones' allegations are true, I've lost all respect for what is now Hoefler & Co. I remember eagerly awaiting the release of H&FJ webfont licensing for years. Quite a shame what has happened between the two, H&FJ was truly a great foundry.

[1] http://www.ecfr.gov/cgi-bin/retrieveECFR?gp=&SID=a71104dd9f0...

[2] http://www.quora.com/Typefaces/Which-foundrys-version-of-Fut...
I have the same rule for month, but for long project we cant stop after two weeks.
Plan for year sounds good.

Thanks for sharing.
kinda reminds me of that guy's web-controlled Christmas tree
Coding Lessons Don't Cure Homelessness
I learned to program typing this into the mainframe at the college where my dad worked and then fiddling with the code to see what happen. I still learn that way.
It was specifically an improved library of those functions. I'll have to dig around on hpcalc.org and see if I can find it again. You could do algebraic calculations if you wrapped the statement in quotes, but once you got used to RPN that made little sense to do.
I don't think "progenerator" is a word.

Did the author mean "progenitor"?
By coincidence, I remembered someone pointing this out to the Go developers no too long ago, after he found out they did in fact roll their own:

https://groups.google.com/forum/#!searchin/golang-nuts/opens...

In light of the current issue I looks like the D guys did the right thing.
And that's probably good advice. Take it as: toy around with lexers and parsers a bit before moving on to more complicated subjects. (Or cheat, and stick with a Lisp like syntax.)
Under US law it would not, as even genuine independent (re-)discovery is not a defense to infringement.
Envisioning: Horizons
TL;DR: He wants the D.
Your having to use two apps there, Facebook has it all in one. Your probably seeing spam because you've like some ridiculous Facebook Page or app that posts garbage.

Just add the people you actually talk to on Facebook. Your friends and family, guys from your gym. Create a group with your Chess Club in it so you can discuss chess openings.

I don't think any one apart from my friends can see what I post on Facebook, not sure you can even share your page with millions of people unless millions of people follow you.
Linode too offers DNS with their accounts, which i've used and been happy with ... https://library.linode.com/dns-manager

They also offer API access (haven't used that yet) https://www.linode.com/api/dns
Is OP intermingling discussion of OpenSSL (a particular codebaes implementation) from SSL/TLS the protocol(s), in a confusing way? Or am I confused?
I think it's cool because Facebook does not only connect people but it also works out to help people feel comfortable with the things they post or share..
Meh...already figured out that Facebook and Google will use and sell one way or another everything they know about me. That's how they keep increasing their profits. So, I use several browsers, ad blockers, different services, never logged in...and I watch what I post.
Same. At work we had a high traffic website using namecheap DNS and we had to transfer to Route 53 to avoid the chance of another DDoS.
I agree with your general sentiment but we're still not there yet.

Unfortunately, Skype hold all your keys and Microsoft changed the architecture to make legal intercept and tapping much simpler. I do not believe it is safe to assume that Skype conversations are private.

Current systems really do rely on users having some understanding of how trust in the application works.

For example, TextSecure really requires you to confirm keys in person (or via QR code etc) if you want to be sure you are not MITM'd. This is not obvious to most users I have spoken to.
Ask HN: Flunking out of college, how to proceed? 
I am currently a sophomore in college, going for a computer science degree and will not be able to finish it. My GPA first semester of freshmen year was bad enough to put me on academic probation. I managed to pull it up and stay in school but currently I am beyond burnt out. I am completely hopeless and very unhappy for the first time in my life. I can’t sleep, often staying up until sunrise. The only thing keeping my sane is tinkering with a ClojureScript/canvas library i’m working on.

I have no willpower to do anything in any of my non-major courses. I love computer science, but it is a struggle for me. Virtually all of my time is spent in my CS and Math courses, and I am failing them too. This will be my last semester, there is no recovering my grades. Luckily my parents are footing the bill, and parental shame aside, nothing terrible is going to happen as a result of me failing college.

I want to just work on something for someone. I don’t have enough savings to pay rent and won’t be able to ask my parents for assistance when I fail out. Living at home is the last option I want to explore. Is there any chance of getting hired without a CS degree? I have three years of summer internships at a C# shop, but all the places around me require a degree to even apply (far northeast USA).

I don’t know how people handle situations like this. Is there some sort of person I can talk to about how to go about getting a job, moving to that location, not getting screwed on rent…

I am lost and frankly, fucking scared. Anyone have any advice, or been in a situation similar to this one?
MSHADOW: Lightweight Matrix and Tensor Template Library in C++/CUDA
MSHADOW is a lightweight C++ tensor expression system support frequently used functions in machine learning. By using MSHADOW, all code can be written once and run smoothly on both GPU and CPU.
Blue Yeti USB Microphone Review
Which, sadly, also reduces the chances of finding who actually produced a given photograph. TinEye and Google Images can help, but, it can be surprisingly difficult to locate the actual origin of a given photo.

(Let alone Tumblr and their infinite vortex of "reblog", which leads to more than a few dead ends)
Good ol' trek was the very first video game I played on the family computer! This was a IMS 5000SX running TurboDOS 1.2, some time in 1983 I think. (Why my father saw fit to buy this thing instead of an Apple II is a question for another day. The best the IMS could do was drive a text-only WYSE-50 terminal at maybe 19200 baud.) Later on, my cousin would dial me into his 3B2 (using Tymnet or Telenet!) so I could play a full-screen variant called "vtrek". I found the vtrek sources on an FTP archive several years ago, but it requires BSD 4.3-style termios, and I just don't have it in me to port it to curses or something more modern.
Interesting. Sounds a bit like this: www.thelogicalbox.com
Also a little like http://www.sumwise.com/

>“It’s really easy to build charts in Excel. But it’s really hard to get the data in the right format to do that,”

This is a famous spreadsheet problem. The only solutions I have seen are a bit like SQL. Hope you find a better way.

Err ... my interest: I am also working on a spreadsheet based startup, a web app builder for spreadsheet users.

Good luck, hope you add a solution or two to our world.
I have found the code from the suckless project, to be a great read. When I was working on a toy HTTP server I learned a lot from http://git.suckless.org/quark/

Another code base I enjoy reading is SBCL. When I M-. into functions and it takes me to something defined in SBCL it always is a great read, and I have learned a lot from it.

FreeBSD is a great one as well, if you checkout SRC it is really illuminating to browse around the source. I have learned a lot by seeing the layout of such a large project.
You see, most people need to justify sociopathic behavior.
it's actually giving the user more granular control over their content*

Granular control is used by what % of people? Experience tells me to watch for a bait and switch from Facebook, if not this update, the next one.
This was also the first computer game I ever played! It was on an HP 2000 computer running timeshared BASIC from a clunky teletype, in the early 1970s. The best part was that you could just type "LIST" and it would print out all the BASIC code - all the games on that machine were open source!

If the Klingons beat you, you'd get this disheartening message, which I remember to this day: "The Enterprise has been destroyed. The Federation will be conquered. You are dead."

I also remember playing a car racing game on the same machine, and also a game about landing a spaceship on the moon (which, a few years later, I created a real-time version of on a 6800 microprocessor in machine language). But the Star Trek game was definitely the best one.
Aren't you severely limited in storage with pouch? I think best case with browsers is like 50Mb with the average being about 10Mb. I can't envision a situation where you could ever index pouch.
Looks neat! Voted to green-light for ya. Now if only I could get an invite to my claar account.. :)
Why Pay More?
In order of priority, it definitely ranks below salary, benefits, how enjoyable the work is, and where the job is located. If my employer happens to be socially conscientious, that's a nice bonus, but I can't see choosing a job based on it.
Nice. I'm making something similar, though more focused on manipulating the data after it's gotten. Have you thought of any cool/useful use cases?
With all due respect, I don't know that TLS/SSL implementation problems will be largely solved by changing programming languages.
If it is common, its likely those doing it want it to remain a secret... so not sure its possible to get a good estimate.
not sure about the original being cleaner, this looks damn good to me
According to Adam Langley, a Go contributor, it can still be side-channeled. https://twitter.com/agl__/status/453370970552532992
This blog post isn't about writing automated tools to detect timing attacks in code, but it has a lot of stuff about how to write crypto code -- elliptic curve cryptography in particular -- that is impervious to timing attacks, very interesting if you ask me: http://blog.cr.yp.to/20140323-ecdsa.html
Except for this bit:

> Facebook is testing a pop-up notification that asks users who haven't reviewed their settings in a while whether they'd like their posts to be shared publicly by default, to their friends by default or another more specific setting.

I feel this is an attempt to get those of us only sharing with friends to reconsider sharing publicly.
This is really interesting. I'll be sure to include these references in my next blog post on the subject.
The goal of the post was to find the equation from scratch, though. As it can be seen, the constant optimization was less the spotlight of the post.
Presentations from USENIX NSDI '14
Experts Find a Door Ajar in an Internet Security Method Thought Safe
I haven't recently, but in the past I've consumed enough for half a lifetime.
Unfortunately this library can only be used in Go, right?
ADV Ocean Shield
> There is no common language better than Haskell at encoding invariants in the type system.

There are a few uncommon dependently typed ones with code extraction to other languages though. Though doing so is fairly time intensive still.
I don't think you all are familiar with what "arbitrary" means. That is the error I am pointing out.
Great website and great idea in general! I love being able to read a concise answer rather than watch a video when time is a constraint.
Excellent! That did the trick. It was nginx and percona that also had to be restarted.
Small Business in the Cloud: Google Apps or Microsoft Office 365
Good Session : Mandy Moore de retour à la télévision 
Découvrez prochainement l’actrice Mandy Moore sur la chaîne CBS, dans la comédie Good Session. La comédienne incarnera une femme nommée Lindsay.
He was CTO there at the time I was contacting him. This has gone on for more than a few years.
PaaS for quickly building web apps
Soft of. It was bought with highly volatile and overvalued stock.
You and your co-workers, please stop down-voting criticism of your employer.
Do you prefer Fogbugz over the Atlassian bug tracker?
You might be thinking of depth-fail shadow volumes, semi-famous for being patented by Creative despite having been discovered independently by a number of people (including Carmack) over the years.
I loved his Zortech compiler, esp. the nice GUI which beat all others, but mostly his C library which came with it. I used a lot of his libraries for while, until I decided that C/C++ is a dead end.

With D he found his mojo, but people are still raving about Rust and are still mostly ignoring Walter. Big thanks to Facebook for deciding on D. Only ObjC came close but D is better.
What Happened to Canada?
It's possible, but my profile is set to "Share with everyone" and I still got a notification a few weeks ago asking me whether I wanted to change mine back to "Share only with friends", so I wouldn't assume the worst.