skysight-inc/HackerNews huggingface dataset:
It's the Steve Jobs conundrum - where someone is an asshole but clearly also very talented.

For me two thoughts come out of this:

1) Yes they've been productive the way they work, but have they been more or less productive than if they'd been just as right but a little less confrontational?

Research generally doesn't show confrontation to be the most productive approach for most people. Is their style productive, or is it unproductive but they get away with it because they're so good that people will put up with it?

You say that the best course of action if you want to avoid Theo's ire is not to write bad code, but how many people have taken another approach? The one that springs to mind is not working with him and how much talent does the project miss out on because people just steer clear? I know plenty of very smart programmers who simply don't go near projects where the culture and personalities are like that. Bad behaviour towards others (even when you're right) limits the available pool of skills.

2) I can live with the arsehole geniuses but others who aren't as able often use the likes of Jobs or Theo to justify their own poor, destructive behaviour. For me at least, that doesn't work - if you're going to be as big a dick but you're not as good as them you're basically just a dick and if the day eventually arrives when the IT industry doesn't have a massive skills shortage, those people will cease to be tolerated.
From the very top of the original disclosure webpage:

"What leaks in practice?

We have tested some of our own services from attacker's perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication."

So they explicitly confirmed they were able to get private key information. I've seen similar confirmations on twitter.

I think it would be extremely unwise to trust that your keys are safe based on assumptions about the malloc implementation. And no offense to the OP, but I think the standard for "don't worry" on this issue is far higher than this blog post.
Heartbleed knocked us down, the CA system is going to make it very difficult for us to stand up straight again - that's the point.
The problem is that almost all 18 year old think that they are that special snowflake that is not average while vast majority of them are just average or worse.
There is also a guard plugin for immediate feedback: https://github.com/yujinakayama/guard-rubocop

Rubocop can even correct some style errors automatically now!
But there is still the question of value proposition to the consumer.

Is the incrimental marginal cost of including the sensor low enough that the improvements in weather forcasting will be demananded by consumers?

I dont believe the target demographic of samsung is swayed towards their products by an additional 5 even 10 degrees of weather accuracy. But i have no data to back this up.
How is it different from Timehop? http://timehop.com/
GSB's Spot Quiz for AI Lab Members
Did the Heartbleed bug leak your Yahoo password?
Yet another round of buzzword bingo. I paused at "shit", searched for "white", "straight", "cis", found all three, and quickly closed the tab.
I accidentally upvoted you, but I disagree. LYAH is a great book to actually read through, and I enjoyed the humor. real world haskell introduces things without explaining and it's quite confusing and inconsistent.
Right, what I was asking in the second question is basically whether there exists, or is planned, a keyset cache to go along with the atom cache. I'd think that, if the atom cache is a good idea, a keyset cache would be good for exactly the same reasons.
108 Ways to Learn to Code
The comment to which you replied was so toxic that I not only banned the user (last night), I did something we almost never do and killed the comment despite its already having a reply. I feel ashamed of Hacker News when I see such things here.

Nevertheless, please don't post comments like yours on Hacker News either, no matter how wrong the other person may be. In such extreme cases, here's what we ask.

Definitely do: flag the comment by clicking on 'link', which takes you to the item page for the comment, and then clicking on 'flag'. We monitor those flags and take action based on them.

Maybe do: send us an email to make sure we take a close look.

Definitely don't: lash back. All it does is degrade the discourse further.
Security Flaws in the Indian Election System
Indeed, it seems I greatly under-estimated the amount of money the author is making. He indicates elsewhere that he made $140k in the first quarter of 2014 alone. Annualized, this is far, far beyond what most freelancers are going to make (and indeed far beyond what most programmers in general will make).

He also clarified that he isn't a consultant. He sells ebooks, which continue to sell even when he's not working, so he still derives an income during his off-time.

In this case, I have to say, though, that the article isn't very useful. Someone with a potential income of >$500k/year, much of which is passive, has so many more options than 99% of people. I suspect the vast majority of the commenters here didn't realize the author was making this much money and also mistook him for a freelance programmer.
Jeremy Rifkin on the Internet of Things
Mailbox Mac Beta Announced
Obviously that would be great, but a tool cannot check that.
They do not have a social responsibility.

It is totally valid for people to call them out for not going above and beyond, but that doesn't mean Mozilla/Debian/etc should be popping them out of CAs.

The mob is welcome to mob, but Mozilla and Debian shouldn't be making decisions based on the whims of the mob.
> Its also basic target motion analysis that a military sonar operator can do in their sleep.

Which makes me wonder: Does the US not have military assets in the area? Or do they and they don't want to disclose their capabilities?

EDIT: I'm behind the times; I didn't know the US had a sub-hunter in the area.
Except the cups must be recycled where you bought them, and when they accidentally turn out to be super toxic Bob insists the recycling fee was clearly posted.

I don't know who's right here, but it's definitely not that simple.
Greg Christie to Depart Apple After Fallout with Jony Ive
That's more like it!
First time I heard about Fizzbuzz, I solved it in PHP. I stay amazed at the 100 lines solutions.

for ($i = 1; $i <= 100; $i++) {

$str = str_repeat('Fizz', !($i%3)&1) . str_repeat('Buzz', !($i%5)&1);

echo $str ? "$str\n" : "$i\n";

}
Silicon Valley is Meddling in India's Elections
+1 Recommend Picturelife.
I have recently written a library that picks N as distinct possible from the RGB color space. Since RGB is not a perceptual color space, it measures distances between RGB colors in CIE Lab. Since the optimization of the most distinct color set can get stuck in local maxima, it uses simulated annealing for optimization.

One nice touch is that you can plug your own random RGB color generators that feed the optimizer, to find N distinct colors in a subspace of RGB. E.g., I use it to generate distinct pastel colors in visualization of linguistic data.

https://github.com/danieldk/quzah

(I am not an expert in this topic, but I couldn't find a good Java library with solid theoretical underpinnings.)
Keeps getting better. Let's hope there will be a single unified cross-platform .NET-Mono-Framework in future with native capabilities.
I somewhat agree on the last point. The temptation is often too great to use those horrible, horrible O(n^2) set functions (nub, difference, intersection) from Data.List just because of the immediate availability.
I run KDE with dark theme, Skype is dark as well. On some inferior desktop environment you could use window inversion. OSX has some hotkey which inverts colors...
How do you prevent the compiler optimizing constant-time operations into non-constant time?
Personally, I think it's more like this:

Alice's Lemonade Stand charges $0.25 for a cup of lemonade,
gives out free refills, and will give you a new cup each time.

Bob's Lemonade Stand gives out free lemonade with free refills,
and gives you one free paper cup to start with,
but you must use the same cup each time.
Bob charges $0.25 to replace a lost, damaged, or dirty cup.

So basically people who go to Bob's Lemonade Stand are incentivized to continue drinking from the same cup even if it's dirty (its integrity is compromised.)

Of course it's not a perfect analogy since certificates eventually expire, but you get the idea.
I like that they configured the 'cap' to be the normal monthly price. It's a smart move that ensures that hourly customers AND monthly customers are getting treated fairly.
Oh, I didn't see that. Upvoted.
Study Offers Paraplegics Hope
Startup: The idea, what works and what doesn't
As someone who has actually had no choice but to write code that uses OpenSSL libraries: if you're going to reimplement a proper TLS stack, you might as well actually spend time to design the API properly. (And use some less insane crypto library instead.)

OpenSSL is used because it has a lot of inertia, and because it still has had a lot of testing. Any new library would need to have an imperial buttload of extremely aggressive tests with near-complete coverage from the start to be even considered an option. Even then the uphill battle to unseat OpenSSL will be long and arduous. Being simply superior and easier to use is not enough. You have to convince an industry, worth tens or hundreds of billions, to actually see big enough a benefit to even consider your implementation as a viable option.

So in addition to economical realities you would still have a massive hurdle ahead: getting crypto right is hard. Really, really hard.

Sure enough, there are alternatives to OpenSSL. But unfortunately it's like having to choose between varieties of cancer or STD's. You don't like the any of the choices, and in fact, you would prefer not to be in a position to have to make the choice in the first place.
She was Secretary of State not Secretary of Defense. I would hope this whole Eich fiasco doesn't start a conservative witch hunt in SV. Not that the Eich thing was really a conservative/liberal issue, but people may try to turn it into that.
Oh? I've never been all that close to the SV startup scene, and as far as I've been able to tell, that was mock-worthy already. Many good things have come from startups, but maintaining a sense of perspective is a good thing, too.
Agreed. This approach is especially nice for situations where you open up the code at a later point, so that people can see the historic progression in more ways than just the Git history. https://github.com/thoughtbot/hound/pull/1
The problem I see with PGP is you'll end up with thousands if not millions of keys you need to keep on hand to decrypting everything. Not to mention the web of trust will be massive and navigating will likely start taking very large CPU power if its strictly peer to peer.

To avoid this most people will start just trusting larger companies; Google, Facebook, Apple, Mozilla. And only checking their keys, since they will trust that company's key. And these companies will handle signing new websites. Small websites won't care if you personally trust them, they'll only care if one of the 'big companies' trust them.

In the end we wind up exactly where we started. Large companies are implicitly trusted by everyone. Sure you may sign your key off to a few dev friends so you can access their test sites, which will make self signing easier. The cost will be mitigated, but in reality nothing will change. Even likely within a 3-4 Browser Generations we'll see non-Company trusted PGP keys get scrapped in all but the more free (as in beer) browsers.
The modal doesn't fit on my screen(MBA) and under the masthead there's just a ton of empty space... gj dropbox.
"problems like this" == "ordinary buffer overflow attack"

pretty sure Rust does magically solve those, as do most non-C(++)? languages
Answer: Every high end luxury good ever marketed.

https://en.wikipedia.org/wiki/Veblen_good
I hope Unity3d improves their C# environment soon (maybe Roslyn will make it easier for them?). The Monodevelop that comes with Unity 4.3 (latest) is pretty buggy.
If you can't trust the certificates they produce, then they should be removed. And there will be a lot of valid-but-dangerous certs in the wild from them.
If it was a StartSSL security leak, then I would expect them to give away revocations for free. But if YOU, the customer, leaked your own private key by running some bad software? That's simply not their fault, nor their problem.
If you work as a programer or similar, your salary will probably increase significantly over the next 10-20 years. Your spendings will increase over time as well.

If you are not crushed by debt, just try to make your spendings increase much slower than your pay.
True that they went bankrupt, but they filed on Sep 20th 2011, and the Mozilla decision to permanently remove them was a week prior or at least on Sep 2nd 2011; thus "unless you were compromised, at which point they'll happily add your new CA" is not correct.

EDIT: To clearify, this is the phrase that we seem to be arguing about:
Complete revocation of trust is a decision we treat with careful consideration, and employ as a last resort. (from the Mozilla Security Blog link above).

They were effectively out in the cold, not "in once you're in" after the incident.
DogeCards: Such Fantastic Adventure Take Doge to the Moon
Timehop shifted focus onto their app. I'm not sure I even get the emails from them anymore. (Checking my timehop email used to be a daily event for me...)
When doing parallax, there's a simple rule that you should follow: something big has to be moving at the same exact speed/direction of the user's scrolling. The full-pauses just makes it seem like you're scrolling but nothing is happening.
No plans to tackle this at the moment, but looks like they have a REST api. Shoot me an email (check my profile) and I'll let you know if I pursue.
One thing I've liked with hound is that when it comes up with what I'd consider a "false positive," such as a line with a url that can't be split, I can just reply inline to explain why that couldn't change. This pull has a lot of examples of that: https://github.com/thoughtbot/griddler/pull/119
Disagree. The jokes are fairly accurate (accuracy checked by professor David Saltzberg of UCLA).

Throughout my life I've drown in conversation of minutia and have adhered to a sense logistical consistency that probably impeded my daily living.

Much of it's silly looking back. BBT theory gets this behavior spot on with Sheldon. I think I enjoy it more because it's self-deprecating.
> What if you take all of the courses which interest you, and that just happens to be enough for both a math and CS degree?

That's great! This means, of course, that the maximum utility schedule happened to lie in the subset of schedules satisfying both constraints, and you so there is no utility loss. The double-major in this case is just an added bonus of doing what you wanted to do, and I'm happy for people lucky enough to find themselves in that situation. From my time in college, though, I remember a number of people who were reasoning along the lines of "Well, I'm just three boring classes away from a double major... might as well pick it up I guess." For people in that situation, where they don't really want to take the extra three required classes, I'm arguing that the double major isn't worth the utility loss.

> Degree requirements exist because the degree committee (and accreditation organization) believe they have have a better sense of overall utility than most students.

Indeed, and good point: If you don't have a good sense of your utility function, then the decision to double major is roughly equivalent to using the implied utility function of the degree committee to help estimate your own utility. However in this case, I'd argue that you would probably get better results from asking a trusted professor or mentor for advice on classes to take, since the person you ask for advice would know you better than the degree committee.
Sometimes I'll browse through designs on http://dribbble.com/, when I see a design where I like the colors I'll click on it and it'll actually show me a nice palette of all colors in the design. What's nice about it is since these designs were done by great designers the palette almost always works as-is which is quite nice. :)
It really felt like a televised red carpet even for an awards show. You get a chance to see all the celebrities and connect with them in the moment. In SV, it's more about becoming them through learnings rather than dreaming about being them through spectating.
Unity is not an XNA replacement. MonoGame is.
Sorry about the miscommunication. I meant to say India reused a lot of its own technology as well as what is available from other resources. You are right that the culture at ISRO is very utilitarian. But please do not try to generalize it for India in general. There are a lot of wasted resources in other organizations.
The patch prevents future attacks.

Replacing certificates and advising users to change passwords prevents exploitation of any previous successful attack. Google have not done anything about previous attacks, but nor have they said such attacks could not have been successful.
Pluralsight Acquires Digital Tutors
How to Break Most Rails Apps
How you stay so aggressively on top of all comments amazes me.
Growth. It's spammy, but it works.
Sadly they are selling to the devil: http://opensignal.com/insights/
ok granted. The last part of the article provides some generic useful tips on being a consultant. I was referring to the statistics and graphs which provide no context when I said it was useless.
Here are the principles I follow:

1. Make the minimal change necessary;

2. Use language that's already there.

By "already there" I mean not adding words of one's own choosing, but drawing on the existing titles and headings or, if need be, the first sentence of the article.
defaultdict is really multipurpose, quick trees is only one of the neat tricks. I like the following definition :)

>>> Tree = lambda: defaultdict(Tree)
Heh, may as well get all the facts straight here. She was National Security Advisor in the lead up to, and first two years of Iraq. The Secretary of State at that time was Colin Powell. She became Secretary of State in 2005.

Furthermore, being Secretary of State would not absolve her from any responsibility that people believe she may have. Secretary of State is incredibly important to any major conflict, probably right after Secretary of Defense. You may recall that Colin Powell worked quite hard trying to sell the Iraqi War abroad.

That said, I don't want a witch hunt either.
Pathological customers: when you give them free stuff, they will demand more free stuff, and if you refuse them more free stuff, they will do their darndest to destroy your business.

Meanwhile, look at all the nonsense that e.g. GoDaddy (who also charges for revocations) is not getting right now. Because the folks with altered understandings of reality got scared away by the $20 or whatever it costs on year 1, and are plaguing StartSSL instead.
Waiting for a sample poster app with all the _idiomatic_ Android, iOS and Windows Phone versions.
I'm not sure this is the likely outcome. There are a lot of people out there savvy enough to not jump on the big company bandwagon - and they would be very vocal about why it's a bad idea too. I don't see your vision becoming a reality for as many as you expect, especially if PGP is brought into our lifestyles a bit more (e.g. email, chat) and the general population begin to understand it - it wouldn't be long before they understood enough to value building their own trust relationships.
At least they followed the snake_case name convention for method names (albeit getters) ;)
Hound is built on Rubocop
Sam Altman interviewed on CNN Money [video]
I agree with you - this is like 100x worse than making Eich CEO - but doubt anything will come of this. The Eich thing was somewhat of a surprise, but no surprises here. If them backing off this decision was possible they wouldn't have gone with her in the first place.
Sounds like it's time to create a competing group that issues standards for the internet.
I hate those github bots. Just use rubocop and run it in your CI.
Wait, what? Didn't someone just post to Twitter this morning that they'd successfully recovered private keys from FreeBSD + Apache?

It's true, private keys are one of the harder things to pull out of OpenSSL due to the memory lifecycle of private keys. But this blog posts goes too far with that analysis.
It's nice to see they've tried to work around the soft 404 problem in their docs, but it shouldn't be necessary. It's just another case of how Google has optimized out a use case that only developers rely on.

I've voiced similar complaints about how google parses my search query, but they seem to fall on deaf ears.

I don't know exactly when, but at some point between 2009 and 2010, google stopped allowing punctuation in exact string matches. An example, say searching for issues related to C# attributes: The first few results for the query "[StringLength]" are for C++'s string::length method, Java's String.Length, JavaScript, etc etc.

Google used to provide uncannily accurate results for such queries and apparently no one noticed when it was changed.
"let = lambda" would be the same thing, wouldn't it?
You are correct: I installed Ubuntu on my first laptop, which I bought in 2001 - I forgot that it ran XP for a time, until I finally got pissed at how I could not access my data the way I wanted to. (Thanks for forcing me to dredge back up those memories, thank you very much.)

I cannot remember if I started with Breezy or Dapper, but it was one or the other.

So a long time then: From B or D to September 2013, when my Air arrived.
The truly paranoid worry that the processor will not execute instructions as they think it will. This ranges from timing irregularities from branch prediction and instruction re-order to bugs in CPU microcode or deliberate backdoors in the the design, or even the fab altering the mask to change the design.
https://eprint.iacr.org/2007/039.pdf
http://www.cl.cam.ac.uk/~sps32/microsemi_re.pdf
Go TDD! Nice structuring of the application.
Not going to happen. Part of the reason is just what you mentioned: they care about their customers. With various clients they would have to support the problems coming from all of the clients and that would cause their service to look bad even though the problem lies within client app.
>Though, FWIW, still sticking with DO for the 5$/mo.

DO claims that the $10/month plan is their most popular... I express doubt, as most people I have heard from are on the $5 plan. From looking at their pricing, the $5/month plan looks like a significantly better deal, in terms of resources per dollar, assuming there is no overselling of disk involved, which is my current assumption.

(My motives for collecting this data are self-serving, but they are also transparent.)
> Dropbox needs people with international experience to help it at once deal with foreign governments that have blocked its use — China, for example — and as it works to spread a product developed in one country to others that are culturally different.

That seems like a pretty weak reason for hiring her on it's own. Would make more sense to hire her on the grounds of having some clout in Washington so your file sharing service doesn't end up doing a "Megaupload"
I also thought about that too. It would be nice to hear from people working at Dropbox if this was the source of inspiration for the app name and page design.