skysight-inc/HackerNews huggingface dataset:
Any result other than "the entire industry scrambling" following the public disclosure of Heartbleed would have been a failure case. How do you imagine that working out? "We need to patch millions of servers managed by hundreds of thousands of people. It all needs to happen today, and be conducted in total secrecy, because if any bad guy finds out about what we're doing there will bet net-wide exploitation by botnets running trivial PoC code within 30 minutes. But no need to scramble, nah, let's do this with due deliberation."
Truth Anonymous Messaging App
Your proposal may want to follow RFC 5785 aka "/.well-known/"

That said, I don't see what problem you're solving or why the solution you propose should help.
Ocean turbines: the Gulf stream could solve the energy crisis
An interesting fact from the Bureau of Ocean Energy management claims that if you utilised just 1/1000th of the energy potential available in the Atlantic Gulf Stream, you could supply Florida with 35% of its electricity. So, if you apply the same logic across the world’s oceans, technically, there is the potential possibility to supply the entire world with electricity.
How To Do Content Curation
Not to diminish Neel's work (nobody will deny that he was already known as being at the top of his game for the last decade or more), but this particular one was blatantly obvious for anyone who audits C code. This just tells us that nobody bothered to look at it for 2 years. If a client had given me this code to audit, I'd have found it immediately. If you were hiring for an entry level auditing type position, or an intern, and they did not spot this, you would not want to hire that person.

For me personally, one of the biggest reasons why I wouldn't have looked is because there is a perception that the probability of things this dumb being missed means looking is surely a waste of time that could be billed hourly to paying clients. It's moments like these that really challenge those assumptions.
> The only niche I can think of is generic technical advise.

I think that's their main thrust at this point.

However, I've recently seen Q&As regarding my home town:

- What are the best restaurants?

- What is parking like?

- What are the hidden gems in the city?

- Etc.

The quality of the answers is higher than what you'd see on Yahoo Answers, and more timely.

So, I can envision a Quora that is valuable outside of technical questions.

But that assumes they can retain the quality and keep the timeliness, IMHO.

To use SO as an example: StackOverflow is running into the timeliness issue: I've been building a Rails 4 app recently, and a LOT Of SEO questions are out-of-date on. I can google around that problem due to my professional needs, but I doubt a general Q&A site would retain an audience in the long-term if the same problem emerged.
Media sensationalism is important when it's a very serious issue.

Security issues of this calibre need more media sensationalism.
Well, yes, frankly, they should. ;-)

Frankly, it doesn't matter whether they do or not, because if a vulnerability is known and there are exploits for it in the wild, then hackers are simply going to try to exploit it, not check /heartbleed.txt.

Aside from all that, sites who don't have the courage to list their unpatched vulnerabilities can simply only list the ones that are already patched.
I'm sure plenty of good karma (even the non-HN kind) is headed your way - kudos.
They still need to pay malpractice insurance etc and more than one person is often billing to that same number so it's not really direct to doctor pay.
That's what an average consultant likely makes as a salary.

$42/hr * ~1980 work hours in a year = $83,160

The caveat here is being a technology consultant is relative to the types of technology problems you're consulting for. Tech Conusltants can much more so today be generalists without much depth in a particular tech skill as the average geek might define. Ie., get your company setup in the cloud using basic cloud services. As a result I do see this position opening up to technically inclined folks in general.

A rule of thumb I've found that can be accurate is you should/can charge about $10/hr for every year of experience you have, and should be working for clients or employers that see value in paying for that kind of experience. At some point that might transition from being an employee to a contractor, and ultimately a consultant.

The lower the hanging fruit, the more the rates lower. Focusing less on technology, and more on business strategy which uses technology as a tool has helped keep my rate fair, and high enough to do quality work.
Uber vs. Lyft: I’m having Kozmo vs. UrbanFetch flashbacks
Not sure I can agree. Different cities have different needs and while it would be cool to have a unified platform to provide everything uniformly, you'd still end up with a lot of different approaches everywhere.
Powerful, Disruptive Shareholders
"In particular, GHC now has all the necessary patches to support cross compilation to Apple iOS, using the LLVM backend."
It was originally 7 fathoms. Later the value was refined a bit because of newer measurements and updated definition of the nautical mile. Why 7, I don't know. Wikipedia seems to indicate that the definition of a knot was derived from that of a nautical mile, but I wonder if it wasn't the other way around originally. https://en.wikipedia.org/wiki/Chip_log#Origins
You can already run a script that does the test in mere milliseconds. Whatever else the merits of this proposal, don't pretend avoiding it keeps you safer.
Why not to use infinite scroll on your website
Wait, surely getting everyone to scramble is a good way to get the fix released soon?
>Your proposal may want to follow RFC 5785 aka "/.well-known/"

This is addressed in a comment below the blog posting.

>That said, I don't see what problem you're solving or why the solution you propose should help.

I don't know how to explain it better than I already have. Sorry.
You're welcome! I know this because I work on the same team with him. I'm not familiar with what Codenomicon did and won't publicly speculate.
so far i like the show.

also i have the weird feeling that i know at least 3 of the fictional characters in person.
Quora seems to have taken a strange turn recently - their email digest is full of creepy racial questions like "do white girls find Indian men disgusting?" and "do Asian men mind if Asian girls date white men?"

I guess you can't stop such questions being asked, but they frequently appear as the top question in the digest and thus in the subject line. I deregistered off the back of that. (Come to think of it, not sure exactly when I registered in the first place!)
What site operator would install something which turns users away? Users will just click OK anyway, and if there is no OK button, users will decide their client is broken and go back to using Internet Explorer.

I'm trying to understand what the workflow and incentives are here. Not every site operator is very security-savvy, and to a first approximation no users are.
Observation of the resonant character of the Z(4430)− state
While that is a very large number, its the gross Medicare payments to the ophthalmologist's practice via doctor/surgeon charges, not his salary. He personally only gets a fraction of that. Granted its a multi-million dollar fraction, but still a fraction.
It's up to the individual to determine whether or not it is a scam. It's up to the platform to make sure the individual can act on what they find. That's where Indiegogo falls short.
I don't go to a hippy church at all. In fact, the church I go to is member of what's generally considered to be a pretty orthodox reformed denomination. But it's not American, and maybe that's what makes the difference here.

I'm not claiming that nobody in my church is anti-gay. I know of another orthodox reformed church in Amsterdam where some people have objected to a lesbian couple's participation in some sacraments. I don't doubt that in more rural areas, that attitude is more common. But it's not remotely universal.

But I wouldn't even count the more liberal church of the late famous Dutch gay TV presenter and vicar Jos Brink as a "hippy church".
Human species "may split in two" due to a dependence on technology
You're demonstrating no understanding of how these things work.

For updates to be deployed, the patches need to be integrated, tested, packages/updates build, and the update mechanisms tested. For complex systems -- like, say, embedded hardware -- this might involve targeting quite a few different devices and testing matrixes.

Even scrambling, this can take days, and leaves users blowing in the wind in the meantime.

This is why we have coordination with vendors PRIOR to public release, such that when the vulnerability is publicly disclosed, updates are available through standard update pipelines, the process is documented, and the update is known to be correct and not introduce deployment regressions.

A vulnerability of this severity needed no marketing. Grandstanding for non-technical users simply increased the likelihood that they'd be exploited while vendors rushed out fixes.
We use CloudFlare at work, but I had not previously foreseen the possibility that it might be needed for my blog.
It's average for "tech". I'm guessing that includes everything from Wall St HFT experts to some guy laying network cable.
I think you have to really dig down and figure out why you want to learn the thing you do? new job? pure curiousity, etc? fun? completing a tangable project. making money of it. maybe multiple things. build a matrix weight each task against the priority matrix. rank each task against each criteria. weight each criteria. compute score. order list. then decide the level until complete for each task. Do you just want to dabble in something? finish a project? etc.
No, it's a good way to get half-broken fixes rushed out the door while users are left blowing in the wind due to premature grandstanding public release.
> All these subsystems have one thing in common: they are incredibly complex and very hard to get right, but seem easy on the outside.

And have teams of operating systems engineers whose entire existence is predicated on them, rather than them just being an afterthought so you can get some other stuff done. If the OS does it, you shouldn't.
sarcasm mode on Great idea. Let's give attackers that have metasploit installed a shortlist of your current system status. /sarcasm

No.
No.
No.
List applications using OpenSSL – OS X
I'm using a brute method to scan applications determining if they link to OpenSSL libraries or code. OSX Mavericks comes with libssl 0.9.8 and 0.9.7 which is not effected by the Heartbleed bug. Effected versions are 1.0.1 to 1.0.1f. Of all of the applications i found installed only Bitcoin uses it's own libsss, v1.0.0 and unaffected by the bug.

Code at: https://gist.github.com/cyphunk/10281386

Example log:

/Applications/0xED.app/Contents/MacOS/0xED
/Applications/Adium.app/Contents/MacOS/Adium
>> /usr/lib/libssl.0.9.8.dylib via /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
>> /usr/lib/libssl.0.9.8.dylib via /usr/lib/libssl.0.9.8.dylib
/Applications/App Store.app/Contents/MacOS/App Store
>> /usr/lib/libssl.0.9.8.dylib via /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
>> /usr/lib/libssl.0.9.8.dylib via /usr/lib/libssl.0.9.8.dylib
/Applications/Atom.app/Contents/MacOS/Atom
/Applications/Automator.app/Contents/MacOS/Automator
/Applications/Bitcoin-Qt-8.2.app/Contents/MacOS/Bitcoin-Qt
>> /Applications/Bitcoin-Qt-8.2.app/Contents/Frameworks/libssl.1.0.0.dylib via /Applications/Bitcoin-Qt-8.2.app/Contents/MacOS/Bitcoin-Qt
Who is "the public" here? Why should package maintainers be hearing about this any sooner than me? I may not help maintain a popular Linux distribution, but I may very well run a service that my customers' bodily safety depends on the encryption of the SSL connection. (Hypothetical.) After disclosure, my only option is not to wait for a fix from my vendors and service providers, but to shut down my service (and lock out my customers) until a fix is available from them (or my own efforts) hours later. Otherwise, the bad actors who would benefit from seeing their SSL traffic would have hours to do so, and for some of us that can cost lives.

This marketing page was effective communication not just to the public, but the hundreds of thousands of technical people that needed to understand that this disclosure was different, they needed to take action, which in this world of plentiful managed hosting, is really not typical.
Also, hats off to the heartbleed.com keepers, Codenomicon, for handling this very selflessly - despite this (fuzzing) being their core business and having found the bug itself. They could have made it a "company logo first" marketing campaign.
I'm using a brute method to scan applications determining if they link to OpenSSL libraries or code. OSX Mavericks comes with libssl 0.9.8 and 0.9.7 which is not effected by the Heartbleed bug. Effected versions are 1.0.1 to 1.0.1f. Of all of the applications i found installed only Bitcoin uses it's own libsss, v1.0.0 and unaffected by the bug.

Example log:

/Applications/0xED.app/Contents/MacOS/0xED
/Applications/Adium.app/Contents/MacOS/Adium
>> /usr/lib/libssl.0.9.8.dylib via /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
>> /usr/lib/libssl.0.9.8.dylib via /usr/lib/libssl.0.9.8.dylib
/Applications/App Store.app/Contents/MacOS/App Store
>> /usr/lib/libssl.0.9.8.dylib via /System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
>> /usr/lib/libssl.0.9.8.dylib via /usr/lib/libssl.0.9.8.dylib
/Applications/Atom.app/Contents/MacOS/Atom
/Applications/Automator.app/Contents/MacOS/Automator
/Applications/Bitcoin-Qt-8.2.app/Contents/MacOS/Bitcoin-Qt
>> /Applications/Bitcoin-Qt-8.2.app/Contents/Frameworks/libssl.1.0.0.dylib via /Applications/Bitcoin-Qt-8.2.app/Contents/MacOS/Bitcoin-Qt
Focusing less on technology, and more on business strategy which uses technology as a tool

How does one go about doing this (other than spending a decade working in a particular domain)? Do you follow any plan, certification etc?
Clearly technical and non-technical understand is a binary relationship. Is there a grey zone of understanding when it comes to Transport Layer Encryption?

I figure there is because most of the HN community inhabits it, and I most certainly do.
Urban Dictionary's scrolling was for a while completely and totally broken on my Android phone. I couldn't scroll at all.
The blog doesn't appear to be served by HTTPS, period.
TCP heartbeats certainly will let you know if the remote end is entirely dead.

They won't let you know if the application process is jammed up --- but TLS hearbeats won't do that for you either! (For example, it's common to have the crypto handled by front-end processes, with the application logic elsewhere.) So if that's what you want, then you need heartbeats at the application layer, not in TLS.

Given all that, the case for hearbeats at the TLS layer for TLS over TCP seems ... weak. Particularly since simply having them there violates the commonly cited best practice that security kernels should be kept small. And this violation has already had disastrous consequences.

Besides, for all the times I see people making this argument, I've yet to see them cite an example of a real problem in a real world deployment for which TLS hearbeats were used, and turned out to be the best solution.
For the record, the overall development experience improved a lot since August, and I'm sure it'll keep improving, so I'm not surprised by your comment :)

Looking forward to what will be made available in the future!
Bright House Networks cable guys are trained spys
I was surprised that HBO allows you to watch the episode on YouTube. For those that haven't seen it, I think it's really good satire.

https://www.youtube.com/watch?v=VvkmsI54ss4
True! It's not a straight salary and docs do have expenses they need to pay out of that money.

I was just trying to call out that the cost of supplies and facility fees are paid by Medicare separately.
The quality of data representation in mainstream journalism is really poor. I guess it's to be expected - most journalists don't really have much of a scientific background and so miss out on having graphing considerations hammered into them. Even publications like the Economist often squeeze and deceptively label graphs. It's a shame that the people informing the general public about science, technology and maths are so illiterate in it themselves.
I watched the first episode of it and I was not impressed. It wasn't really funny and it wasn't really exciting to watch.
I thought about a "hackers.txt" around the time "humans.txt" got popular. It would be stored not in a publicly accessible location, but in a location where finding it would mean a data leak (private web folder, users.sql).

It would have information like a unique security email contact, bounty for responsible disclosure and congratulations on a job well done.

These heartbleed attacks do scare me. They scare me enough that I get the feeling that resistance is futile. Changing your password on a few sites is not going to help when the opposition controls every bit of fiber between you and the website you're logging in on.

I do think that sites should disclose much more prominently when they were hacked. A few days ago there was the headline "Chrome inadvertently blocks wired.com". I think such a headline should be "Wired possible serving malware for a few hours yesterday". No "heartbleed.txt" hidden away, but a large banner across the top of the site: "We were hacked! Read more here! Update your virus scanners and scan your computer."
How to protect against Heartbleed and future vulnerabilities
Is GHCJS easy to install now? I'm very excited about that.
Yes - you can now compile Haskell code to run on iOS. There are still a few unusual steps that involve ffi but its pretty easy to get a trivial project up and running. I have an unfinished project that shows the process.
https://github.com/schell/blocks
>"...Cannon 'has a special kind of hate for gays' and opposed employment protections, adoptions by same-sex couples, abortion, and voting rights while backing the state's constitutional amendment banning same-sex marriage."

How is supporting someone with views like that, who would then be in a position to change legislation (or not) to support his views better than supporting Prop 8?

Also, if it's not let go due to an apology, why are you giving a reason for letting it go that was straight from the guy's apology?

Seriously.
>What site operator would install something which turns users away?

The point of this proposal is mostly to enable sites to tell users that they _have_ been fixed (and when), not to tell users that they _haven't_.

Having said that, site operators pay to install valid SSL certificates from valid CAs because they know that if they won't, the browsers will increase the friction necessary for users to access their site.

If something like what I am proposing is widely adopted, then not patching their sites and notifying users that they have done so will similarly increase friction, so site operators will have an incentive to do it.

>Not every site operator is very security-savvy, and to a first approximation no users are.

The penetration of password management apps like LastPass continues to increase. The fact that many users do not choose to avail themselves of better security is no justification for not implementing better for security for the users who do.

If that were not the case then SSL would not exist.
Is payment for revocation standard practice? I've reissued and revoked probably a dozen Comodo certs (both directly and via Namecheap as a reseller) without issue.
I don't get it either. I am an old programmer full of habits too I suppose, but I had no problem to adopt mandatory curly braces after reading the rationale for mandatory curly braces in Golang years ago. I would think the Apple bug was an even stronger rationale to adopt mandatory curly braces habit...
Akamai was notified and completed the patch in advance of public disclosure according to their Heartbleed FAQ: https://blogs.akamai.com/2014/04/heartbleed-faq-akamai-syste...

This raises the question about whether Amazon/AWS was notified prior to public disclosure.
Yes. Everything but certain naive use of template Haskell or use of ghci is supported for targeting IOS. There's also some related engineering to provide android support
How to order records by impressionist_count
They can just use NSA-style semi-random codenames. Every CVE can be automatically assigned a pair of words out of a hat. It'll be particularly beautiful when combined with already-silly software names. I want to have to tell my boss that Raring Ringtail has been affected by Nevada Horseshoe or somesuch.
One of the things I'm taking from this episode is just how worthless a lot of prognostication about security by a load of "experts" on the internet is, especially of the "trust us to get it right" variety.

Frankly, their whining about how hard crypto is is partly responsible for the monoculture we have. Yes, it's difficult (more so in protocol than implementation), but they are so offputting to new people coming into the field it is insane.

Clearly OpenSSL dev is broken, at least partly because everyone assumes everyone else is auditing all 300k lines of it, but also I can't help wondering if this calls for stronger component isolation within cryptosystems. For example, protocol implementation, encoding and decoding seem like they should all be totally isolated, so a disaster like this doesn't mean you could be leaking information from the rest of the system. I imagine many a HSM vendor has been quite pleased by this news.
10 Tips for a Software Résumé
As others have pointed out, if they have metasploit installed they're just going to scan your site for all known vulnerabilities in a matter of minutes. Making it easier for the good guys to find out whether you've patched Heartbleed is not going to make things any easier for the bad guys.
Those projects don't suck, though. When projects (continue to) suck, it's usually because their maintainers suck. When maintainers suck, it's hard to get patches in.
I'm the guy who had to do it at my company, and in a previous career I'd be the boots-on-the-ground dealing with it at a rather larger company. I understand that vendors want a few weeks. I have lived the reality of ponderous engineering processes which need weeks to approve the smallest imaginable change. The for loop does not care what we want and does not get slower at counting to big numbers just because we are slow at counting to small numbers.

I understand that vendors find it inconvenient to field questions from users like "Are you vulnerable to Heartbleed?", most particularly when they are, in fact, vulnerable to Heartbleed. I respect that Yahoo feels embarrassed that there is a screenshot showing usernames and passwords in the clear. I think that the feelings of Yahoo users who would be discomfited that their email accounts are available to anyone with a command line deserves at least as much deference.

I also think it is a radically borked threat model which suggests that attackers only find out about vulnerabilities when the man-on-the-street does rather than when really-savvy-vendor-folk do.
What does a tech consultant do exactly?
Luite is probably going to announce something like that in a few days. Ghcjs getting ready for general release was blocked by ghc 7.8.1 not being released.
I can't read the article, so forgive anything that's off base here....

Omitting that seems ludicrous. Without that, you're really answering the question, "why are they called 'knots'". Which is interesting, but completely different from the question of why you use knots.
Why I left VentureBeat to found a startup
I'm inclined to agree with the consensus here, so far. As soon as I saw that 38.8 hours a week was the consideration for "long hours", the rest of the article became suspect.