skysight-inc/HackerNews huggingface dataset:
Is a "Reverse Heartbleed" exploit possible to read the client's memory?
So here's a question about the recently-discovered heartbleed OpenSSL bug.

Let's say I connect to a server with Firefox/Chrome. Could the server read the client's memory and extract cookies/history/sessions for other sites the client visited?

I'm not sure if firefox or chrome link against OpenSSL, but that could also be pretty tricky.
Would it make sense for everyone to change their passwords because of this?
Hmm. I really like this, and I'm definitely going to use it when I finish my service. However, I have two small problems and one large problem with it:

- It's impossible to go back and select another payment option once you click one of them.

- You can't style your payment dialog. (This may be a good thing [consistency], but I think it'd be nice to be able to add custom CSS to the pricing dialog.)

My large problem is that the price is crazy; your 50 cent per transaction fee means that for all transactions under $7 you collect more in fees than Stripe does. With a $5 payment - very common for services such as the one I'll release soon - I'm paying 20% to you. With a $1 payment, I pay a prohibitive 83% in fees. That's a really large cut compared to using the Stripe API directly, and I think that for anyone looking to increase their profits it's a no-brainer to cut Snappy Checkout out of the equation.

To give a personal example, my service will be primarily receiving $5 payments. For the first 1000 payments or so, I'll probably stick with Snappy - the $500 I give up isn't worth the time I would've spent rolling my own solution. However, as soon as I can see that there's a clear market for my product, I'll roll my own with Stripe - I clearly wouldn't want to give up 20% to payment processing alone.

Meanwhile, Frank is selling antique vases on Facebook for $1.5k each, and he pays 50 cents a transaction to you.

However, if you were to switch to a flat fee + a percentage (say 1.5% and 15 cents), as Stripe does, you would probably retain my business for a lot longer. Suddenly, I pay a 4.5% cut to you as opposed to a 10% cut, which is quite reasonable. At the same time, Frank the antique vase seller doesn't really care about a 1.5% fee: a win-win situation.

tl;dr I recommend that you change to a percentage of the total sales: sellers of cheap items will use your service and sellers of expensive items won't care. There's a reason why Stripe, Visa, and every other payment processor everywhere ever does this.
MonoGame is meant to be an OSS XNA replacement. It's very good for indies with good programming skills. Fez and Bastion were implemented using XNA/MonoGame. If one is more of a game-designer/scripter or is business-oriented then Unity3d is also a good choice.
> All network access is abstracted away

Which is a BAD thing, because it's one hell of a leaky abstraction.

http://en.wikipedia.org/wiki/Fallacies_of_Distributed_Comput...
Doesn't it say 26T which is $706,675.75 USD?

`With the bar set at 11 trillion ISK in damages during the battle of B-R5RB on Tranquility in January, Serenity went ahead and smashed that record, almost doubling the ISK value of hulls destroyed at an astonishing 26 trillion ISK worth of damage.`
> Kind of hard to believe it took this long to get SIMD though!

Does the JVM have SIMD?
Always be shipping :)
The game is shockingly good looking these days. Normally there's not that much going on in one place, and instead it's wide, desolate space (which has it's own beauty). But there are a great many special touches, from the mild red/blue shift in warp to the unbelievable overkill on the character creation, the game looks like it has had years of tweaks and refinements added.
Superverse game gets the new visual identity
Mmmm I wish I still had the time to really get into persistent MMOs. I recently got back into playing this really old school MMORTS called Mankind that is still chugging along.

Total. Time. Sink. Still, it's been fun.
Gay marriage opponents say #Nozilla after CEO resigns
When people say Moore's law is finished they are saying that the free lunch that was the growth rate of single threaded performance is gone.

25% isn't bad, but is no where near the 60% we were getting before. Especially since a 2 year wait used to be a 150% boost but is now a 56% one (with many analysts thinking that is generous).
Ask YC: What % of YC participants do you source from HN?
Do you guys track this metric? It would be nice if you could share numbers but I'm interested in how helpful Hacker News has been in directly sourcing companies to invest in.
Many servers will still be vulnerable, so now you have 2 problems.

Zawinski meme aside, perhaps it would make sense to do it on a server-by-server basis when the machines are verified patched. (Though, even then, how do you know they aren't passing information back to an Internet-exposed-but-unpatched database server?)
Jon Lax from Teehan+Lax on topic of utility value in digital products
Level 12: remote control!

https://gist.github.com/anonymous/dd3e906ad36d87158528
I'd imagine people have been charged with crimes for much less than what one could attempt to charge this author with if some scriptkid uses this code and causes damages.

I respect the author for wanting to be a part of the community contributing code related to this event but some self-preservation might be in order...
I can't decide if I want to see ethereum implemented in dwarf fortress ... or dwarf fortress implemented in ethereum ...
I think the "never gonna happen" was about JS and Node taking over the enterprise.
I would love to see a pure merit based approach. Let people see github accounts and make offers based on that alone. Maybe we can evolve farther past age and race issues if we focus on work.
Completely anecdotal, but I would bet it was due to difficulty getting returns from the program. DirectX itself helps sell licenses of Windows, but XNA not so much due to only impacting indie games.
So what you're saying is that the photos for 4 out of 5 candidates will be junk shots?
The fraud is that these vulnerable sites are risking their users' private data, while pretending they are not.
Yeah. We should still take Rumsfeld's advice about what we don't know.
Thanks for the feedback. We agree, Hired is great. We love and respect what they're doing. We believe there's a big enough market for two similar companies to exist. Currently what makes us different is that we're mobile focused. Along with Design, we focus on iOS and Android engineering talent. Another way we're different is that our auctions only last 24hrs. Again, thanks for checking out the site.
This is a well put together reply, very politically correct. Good to know you're on TokuMX dev team.
Previous thread:

https://news.ycombinator.com/item?id=7546300
I think you are describing a larger encryption scheme that uses SSS as a component. I am talking about SSS itself, which is unbreakable, from an information theoretic standpoint. You can use SSS to split the clear text among all participants, even if most people don't use it that way to construct larger systems.
So you can't trust the US, UK, Canada, Australia, NZ, Germany, France, basically all of the West, who can you trust?
Here's the recap:

Tweet: 100 characters

Facebook post: less than 40 characters

Google Plus Headline: less than 60 characters

A headline: 6 words

A blog post: 7 minutes of reading or 1,600 words

Email subject line: 28-39 characters

Presentation online: 18 minutes

A domain name: 8 characters
Although this technology preview only works on 64-bit Windows 8.1, Microsoft's Kevin Frei promised that this will be released for "all platforms that .NET supports" in the future: http://blogs.msdn.com/b/dotnet/archive/2013/09/30/ryujit-the...
We're working to fix font on all browsers. Thanks you for letting us know, and for checking out the site.
https://github.com/rails/rails/compare/v4.1.0...v3.2.17
NSA logs reveal flood of post-Snowden FOIA requests
Rails LTS now supports Rails 3.0
Negative effects? How so? It might be discovered? It is true that focusing on negatives can be counterproductive, and some negative emotions are better off unexpressed. However, I am following the advice of a Harvard business school professor to "quit early and often" in this case. I have other projects of my own that I wish to pursue. What I have decided is to encourage my cofounder to find others he can work with, which he is doing. No agreements are written and no company or partnership has been formed, so there are no contractual issues. (Maybe a loss for me if the venture does eventually become successful, but I believe this is a low probability event.)

I did try to improve things after my first pseudonymous rant (which you noted). Remaining professional under difficult circumstances was a good exercise, but I have had enough. The experience of finding work in a place free of manipulation, hostility and psychological baggage led me to the conclusion that I need not suffer these things, especially not in a spare time project.
It went comparatively smooth for us. 2 to 3 was a nightmare, 3 to 4 wasn't too awful. Some of the things that bit us:

* Strong parameters means you're going to have to figure out what everything needs for params or break down and call permit! where acceptable. If anyone got crazy with attribute metaprogramming bullshittery, you're in for fun.

* The deep_munge part of strong parameters has some strong opinions about how it should do its job. The code is there to prevent attacks where unusual user input is handed directly to ActiveRecord and interpreted by it. One special case to look out for is that it will rewrite a (JSON-supplied) empty array into nil, which makes life fun if your API happens to put some semantic meaning on nil vs. empty arrays.

* The new restrictions on routing verbs are good stuff, but I can almost guarantee that something was getting away with using the wrong verb before.

* XML parameter parsing has been extracted to a plugin. For some reason XML generation wasn't, but if people are sending you XML data you'll need this: https://github.com/rails/actionpack-xml_parser

That's all I can think of off the top of my head.

In response to this:

> Does that mean I need to go through and rewrite all our models and controllers before we can update?

Not really, no. As a first step we rewrote all of our attr_accessible usage into model class-level constants we could run through strong_parameters. Eventually those moved out of the model, but it was good enough to get going. Example:

# Rails 3.2

class Foo < ActiveRecord::Base

attr_accessible :name, :bar, :whatever

attr_accessible :name, :bar, :whatever, :approved, :as => :admin

end

# Rails 4.0

class Foo < ActiveRecord::Base

UPDATEABLE_ATTRIBUTES = [:name, :bar, :whatever]

ADMIN_UPDATEABLE_ATTRIBUTES = UPDATEABLE_ATTRIBUTES + [:approved]

end
Here you go:
http://pastebin.com/Kbzr3DFv
It seems someone loses either way. Charge a flat fee and small transactions are more expensive. Charge a percentage and large transactions are more expensive. I suppose you could do some combination of both, but that would make the pricing more complicated to understand.

I don't know about everyone else, but I would care if I was being charged X% to sell a $200 item -- even more so if there were options to pay a flat fee.
Shit Hackers Say
Sure. It's not a perfect alternative, but it's an option. I imagine it would be a happy negotiation. Basically just trying to figure out what multiple the VC would want and negotiating a fair outcome.
I just wanted to back it up as one of their paying customers for the past 5 years who had plenty of interaction with the owner.

Ironically your comment brings even less value to the table.
I have a feeling that we're going to start seeing a lot of this post LogMeIn's cancellation of free services.
Security is a best effort thing. Get used to it. Make note of which providers fell short here and act accordingly. Questions?
Not only will someone not truly hear what you have to say, they will often become confrontational over it if it is anything of relevence.

Considering this and keeping my mouth shut has saved me many a fruitless argument.
Introducing Conversations: A Whole New Way to Work
And that's why it doesn't matter at all in the Ruby / Rails community ;)
These kinds of posts are destructive, and provoke arguments. Please don't do this on HN.
Puking On The Startup Rollercoaster
11 trillion was the old record. This was way more (I think one side lost 17 trillion just in Titans -- can't be bothered reading the article again)
The beginning of this blog post screams that the author doesn't care about facts.

"Mozilla (the maker of the Firefox search engine)"

Really?
A Hot New Blog Featuring Emerging Artists
Yeah, that's why I still used the service even when they went more annoying. I guess I'll need to finish the work I started on moving to an alternative solution.
Rendering on the client side is not even possible with the vast majority of handheld devices in use around the world. The biggest issues are, as they have always been, the fact that commercial interests have triumphed over any kind of inclusive standard practice.

Please understand I'm not passing judgment on the matter -- but I would like to highlight the relatively elite status of people with quad-core telephones.
50 ways to market your small business on a close to zero budget
Netflix has been fixed.
Validatinator – Full Blown Vanilla JS Form Validation Lib
Wish there was a website for remote developers to announce their candidacy.
This is the problem with a monoculture in security libraries. Back when the gnutls vulnerability came up earlier this year, some people seriously stated that we should only have one tls library and that would ensure the security of it.

Find a vulnerability in a browser, and a minority subset of all users get effected. Find a issue with openssl, and key to the kingdom is there.
In terms of being responsive to issues, I've actually had far better response from Microsoft than Yahoo, as I described above. Call the switchboard, ask for the SVP in charge of the division, get transferred directly to him, he picks up the phone on the first ring and talks for ~10 minutes to hear my issue (spam transiting Microsoft's network). Tells me I'll hear from the manager in charge, who calls me 15 minutes later and works over the course of several months (these things do take time) to resolve the issue and improve their systems.

As I wrote above: I'd written Raymie Stata repeatedly after getting a complete runaround from Yahoo's tech support (and diving into dead ends on their website), never hearing a peep from him. Not until I emailed pretty much the entire C-level suite and senior managers with a bit of data showing the nature of the problem (postfix delivery time stats) did I get a return response, from Yahoo's "concierge" service. That finally resolved the particular issue I was dealing with, but that's one appropriate response in years of dealing with the company.

The resolution with Yahoo was essentially the one described in your Serverfault link: get explicitly whitelisted. That's not uncommon with top-tier email service providers.
>You are referring to using an index, correct? Because grep is absolutely, madly efficient for a doing a full search.

I'm not sure why you imply that a full search is incompatible with an index.

Perhaps you meant "full scan", that is reading everything while searching, instead of "full search" (searching everything). The first is not a prerequisite for the second.

In any case, grep is a very inefficient way of doing a full search. An index is so much faster it's not even funny.

>The index portion of a file system are called files and directories.

Those are just indexes for the names of the files and folders, and a few other select metadata. Nothing like a full-text search index, or even actual indexes on metadata.

(Some filesystems allow those too, e.g. in BeOS, but nowhere as comprehensive and flexible as using a dedicated tool for this, be it MongoDB or something else).

>Several file names can refer to the same data. Those are called hard links. So with hard links, I can refer to a Foo by their related Bar.

Sounds like a convoluted and inefficient way of building something somewhat like a "document database" with 1/10 the features (if that).

>I'm not a Mongo expert because no one could convince me otherwise to date, somebody correct me?

I'm far from a fan of Mongo, but you seem like you have already made up your mind, and nothing will change it.

Plus, if a filesystem is enough of a document database for you (with no cheating, e.g piling up tons of hacks and add-ons like external full-text scanning tools), then be all means, us one.
Betty – Your Personal Scheduling Assistant
The other problem is that EVE is advertised as a "choose your own destiny" sort of game, but if you choose to perform low-risk work in highsec you will forever be mocked as a carebear by 75% of EVE players. It gets tiring, regardless of how thick your skin is. I learned quickly that you might as well not even post on the forums; "carebears" are second-class citizens and most players consider it okay to level homophobic and other slurs at them (and this is encouraged by the game's culture).

It's also hopeless to work in highsec (and usually lowsec), really.

EVE: "Choose your own destiny, as long as that destiny is nullsec PVP."
That would we be nice.
12" is about a third of the length of a Bald Eagle or slightly shorter than the barrel of an M4-Carbine.

EDIT: I just measured and 12" is about 3 times the diameter of a McDonald's Quarter Pounder patty.
Or a pure Lua JVM

https://cowlark.com/luje/doc/stable/doc/index.wiki
Imprisoning users who check for the vulnerability doesn't seem like a best effort. It also doesn't seem likely.
As long as it's valid hex it should be fine, there seems to be a lower bound at which point servers don't respond but I didn't play around for too long with that part.
Most articles also mention 64kb which the script can do with some small modifications.
Inevitable... moved off DynDNS earlier this year in favor of Amazon's Route53. DNS bills went down 99%... and Amazon has been great.
Very happy to get a reply from someone from LastPass!

So then what would prevent someone from using the Heartbleed attack to obtain your private key that use used to secure the HTTPS connection from me to your servers, then inject malicious JavaScript into the page where I enter my password? This is the attack I am worried about outside of Heartbleed as well, since any CA can issue a valid certificate for lastpass.com and I would not know that I am being MITM'ed.

From a strict security point of view, disabling website access seems like the best policy. From a usability standpoint, I understand the tradeoff you made. Perhaps an option at the account level that disabled website access might be a good idea.

Also, how are the share/give functions handled? I know what "share" is not really keeping my password from being seen by the other person (there are a variety of techniques they can use to get at it), but how is the encryption handled on your end?

Lastly, how do I know that the browser extension I download from you is secure? Is there a way for me to verify it somehow?

Having said all that, I absolutely love your product and recommend it to everyone I know. It's a huge net win in terms of security.
If this were true, the Rapid7 guys would have been in jail long ago. This doesn't do anything more than the original PoC, but shows another reason for administrators to update their machines.
What about candidates whose merit comes from what they did in companies and not in open source?
Veeva Systems (VEEV) took just a touch longer at 6 years and did it with remarkable capital efficiency. Founded 2007. Raised $4m from VCs. IPO in 2013. Opened at $2.4b mkt cap, closed day at $4.5b, $5.6b today.
Perhaps not applicable to many here, but for students you can get unlimited users. It's a great offering and could well pay off in the future at Github's expense.
The Girls Next Door
On my first run today I saw some passwords going to the admin section on our staging servers so it really depends on what you're targeting.
You could use something like Native Client to run multiple protected "processes" in a single address space.
If they are prohibiting (or even DISCUSSING the possibility of prohibiting) you from creating repos under your personal, non-work-related Github account I think it's safe to say it's time to go elsewhere.
There's this, but I haven't tried it yet: https://github.com/PwnicornDev/heartbleed-test.crx
Postgres for Developers
Trends and fads move on, but great design is timeless. Great design solves a problem completely.

The Eames Lounge Chair was designed in 1956. At no point since then has it looked dated. And it never will. It's timeless (and comfortable as well).
http://www.hermanmiller.com/products/seating/lounge-seating/...

Its difficult to make timeless work with software because the capabilities and mediums change so rapidly. But we'll get there eventually.
I agree, OTP is optimal, it's just not unique, even by a very broad definition of what an OTP is. Sending a Turing machine to the other party through a secondary channel, for example, would produce an equivalently (not more) secure mechanism. Or sending a normal real number as the key, and the ciphertext is an index into the base26 expansion.

Technically, either of these could be slightly more secure, in that they need not leak the length of the plaintext. For transmitting a single "yes" vs. "no" answer, that could be a fatal attack vector for a naive OTP.
They should be able to put something together on their Github to demonstrate skills.

I rarely hire anyone without it these days.
Were AWS API services affected? Is it possible that someone may have stolen private credentials and is now able to hijack customers accounts?
Fortunately, engineers are a significant target market.

In the real world, simplistic ticketing systems fail to meet enterprise needs, which are complex and peculiar, arising from weird contract clauses, irrational political outcomes, legacy processes etc etc. JIRA's multi-layered customisability is a huge boon in these environments.

Also, people aren't actually stupid. Yes, even non-engineers can use a complex piece of computer software! A little training goes a long way. Who knew?!
> ActionController::Live still feels pretty half baked.

It is very half-baked. I put it into a production system and had tons of headaches.
I really don't think the block chain is the next platform or even that interesting. What exactly am I missing?
We can't edit our workflow due to another bug or situation (or lack of documentation)
I am literally just parsing the output of the original PoC.
I laughed when I saw the location. Yeah, I'll just put "Middle of no where, USA"

Despite a lot of talk about remote work on the rise, I've yet to see most companies encouraging it or able to manage remote workers.

Least you could do is make it check for the users location via geo or at least ip and make that the placeholder text.
Yikes, I didn't know the latest GPL compiler doesn't contain a linking exception. That is disappointing.
But this battle was in China where isk x real money prices are different, apparently the PLEX (the only formally recognized way of turning real money into isk) is a lot more expensive in-game over there, thereby depressing the real-money value. According to [1], isk is worth 1/6th in the Chinese server, meaning the total damage was around $110,000.

1: https://forums.eveonline.com/default.aspx?g=posts&m=3921938
As someone who has been to way too many hackathons, this video resonates with me so much that it's depressing.