skysight-inc/HackerNews huggingface dataset:
The funny thing is the fact that everybody is ignoring that the patch wasn't a patch. It was a POC (read demonstration) with the notes:

'...This patch is a variant of what we've been using to help protect customer keys for a decade.

This should really be considered more of a proof of concept than something that you want to put directly into production. It slides into the ASN1 code rather than adding a new API (OPENSSL_secure_allocate et al), the overall code isn't portable, and so on. If there is community interest, we would be happy to help work on addressing those issues. Let me restate that: do not just take this patch and put it into production without careful review.'
New startup aiming to help sick loved ones
HospitalCarePacks is in business- to help you show loved ones you care for just how much you care. This new startup will deliver a personalized basket to a hospital room anywhere in the U.S.
In the HN guidelines:

> Please submit the original source. If a blog post reports on something they found on another site, submit the latter.

The first line of this article refers to its original publication in Wired:

http://www.wired.co.uk/news/archive/2014-04/11/glow-in-the-d...
I'm guessing the patch was broken because they didn't have an actual patch laying around, they had to do a diff against the upstream and try to pick out the relevant parts. That doesn't excuse some of the other errors though, like integer overflows and not checking return codes. That also doesn't excuse the fact that they didn't actually try the patch before sending it out.

There could be other pieces that we're missing, and this patch alone doesn't prove that you can obtain private keys from Akamai's servers with the Heartbleed bug. It just proves that there could be key parts outside of their protected storage area and they suck at creating patches of their modifications. That being said, I'd love to see someone apply Akamai's OpenSSL patch and still pull the key with Heartbleed.
Financial Advice for People Who Aren’t Rich
I believe we're doing the same thing here at the Government of Canada.
Buscando seguridad para niños en el hogar
Half-Life in 20:41
You know client certificates can be used for this, right?
I haven't read the article (I'm in the UK), but I currently do not, and I hope I can continue with this principle.

In particular, I don't even drink coffee. I refuse to put my health in danger just to please my employer. Now, I usually don't eat heavily carbohydrated food, which makes me sleepy, during work, and on the rare occasions that I do, I can afford to doze off for 10 minutes without fear of being fired. I know that most people aren't that lucky.
After reading your responses and claims of complexity and architecture, I don't think you understand PKCS#11, the problem domain, or the architectural constraints to a level that is commiserate with your expressed level of certainty.

I say this as someone who works on PKCS#11 code: It's not really possible to have a productive conversation with someone that is missing key domain experience and knowledge, but is so certain of their correctness anyway.

More concretely, a forked daemon only needs to support RSA and other crypto operations without revealing their keying material. They don't need a full TLS/SSL stack.

That said, there's absolutely no additional complexity in having both Apache and the hypothetical daemon using a full TLS/SSL crypto library. Any __TEXT pages will be shared, and duplicated __DATA and base-line library allocations are essentially zero.
500k commits
"get the maximum energy during the year."

There are already countries where the cost of electricity from PV is below the cost of electricity bought from the grid. In these countries every Watt you generate yourself saves you money.

These users don't want to get the maximum amount of energy per year, they want to minimize the amount of electricity bought from the grid. They want to better match the generation profile of solar to their load profile. i.e. spread generation across the day - instead of getting it in one big peak in the middle of the day. To do this - it is already common to install east and west facing PV.

But I agree lazy journalism - he's speculating about a future which has already happened in some places.
The word 'conspired' makes it sound like a secret arrangement. If I understand the reports accurately, his requests were made openly to casino personnel, with no consideration offered to the individual employees. He was tempting the casino bank itself with, "I'll be a happy high-roller who keeps playing if you indulge me".

So it starts to look like: the casino, experts in the game with a large staff that had both the duty and capability to monitor the situation, chose to offer a game with a positive expectation for Ivey.
"It's nuanced and detail oriented" would be my answer. I'm not a cryptographer, but in my dealings and exploration I've found lots of issues that just aren't obvious, e.g. timing attacks and length extension attacks. There are also many things that are obvious, but require care to do, e.g. single-use nonces and authentication.

A mistake in crypto can invalidate your entire system, not just make it unreliable or crash, and those mistakes don't have to be something obvious, there are many insidious little things that can happen as well. That's my take on it.

That said, I believe that software engineers should learn basic crypto and fiddle around with their own ideas, _with the understanding that there is always someone smarter than them_ in order to understand some of the problems they'll be facing.
But not out of user. If I can run code as your user, I can attempt to retrieve those keys, although I assume MacOS prevents you from attaching a debugger to the keychain.

Linux has Gnome-keyring, which, amongst other interfaces, operates as a PKCS#11 softhsm (I think), but it still runs as your user.
Let's say I'm not interested in spreads or liquidity beyond being able to within a day or two purchase or sell a share that pays dividends on company earnings.

What would make me want to go with a market that offered lower spreads and more liquidity? How would it affect a long term holder?

Isn't there a cost to all of these transactions occurring?

Like, why do I need the spread to be as small as possible? How much is actually saved? How much are the infrastructure costs for maintaing a marketplace that supports these high frequency trades? Isn't there room for a much simpler, low frequency marketplace that had fractions of the operational costs? Couldn't savings be passed on to retail investors with a cheaper marketplace?
Justin.tv's Justin Kan: The story of a serial entrepreneur
Something also to know is there are multiple ways to embed images in wiki pages. There's the standard Markdown syntax, but there's also a syntax that allows things like specifying the height or width of the image. Example:

[[ image location | height = 300px ]]
These guys are doing it for a whole app. Maybe get in touch with them. http://techcrunch.com/2014/04/11/app-io-turns-ios-apps-into-...
Came up with this site today, what do you guys think? all in one product from the looks of it http://soosci.com
Rome 'ages' 200 years as archaeologists discover new remains
http://www.php2python.com/ is great.
This is DANGEROUS advice. Email is typically one of the easiest channels to access. There are dozens of ways that someone can get access to your email, it shouldn't even remotely be considered secure.

For low security content it can be acceptable, I've used this method for email subscription centres before, however the only actions a user could do is manage their email subscription and thus it was considered to be acceptable. The idea that this method would be used for a SaaS product that is being paid for is mind-boggling.

Thats not to say it couldn't be used in multi-factor authentication, but tying the only authentication to email is creating a giant single point of failure from an insecure system with a shoddy security history.
It's called pumped storage. It exists, but only at larger scales than a household system. It's ~80 efficient.

http://en.wikipedia.org/wiki/Pumped-storage_hydroelectricity
Addressing the Exchange part, no they're really aren't any good nix applications capable of using exchange. Thunderbird can do it with a plugin but you aren't getting contacts or calendars and you'll only get email if the guy who setup the exchange server allows IMAP.
It would be really interesting to see which genes in the section of chromosome 7 that is deleted in Williams syndrome have been under recent strong selection in humans.
That's true, the rediscovery of American heritage clothing may have happened anyway, but I have to imagine the boom in American workwear/sportswear has been made dramatically easier for modern designers thanks to the Japanese otaku that have studiously collected, documented it (Free & Easy, Lightning Magazines) and continued to produce it (Buzz Ricksons, Real McCoy). Due to this, a route to revitalizing an American heritage brand is to simply hire a great Japanese designer. If no one had cared I do think it would have been a much more difficult process and I do think it would have been likely that some knowledge could have been lost.
Heads up, the application is placed in ~/Desktop and not /Applications
A review by a security engineer would have prevented a false sense of security

Everyone involved in this, from the people who wrote the heartbeat code, the people who committed the code, the people at Akami who wrote this patch, this poster ... all would describe themselves as security engineers. Is everyone but Willem Pinckars incompetent?

I think the one lesson to learn is to treat crypto just like you do cloud providers. Make sure you have an exit strategy from day one; the ability to push a button to roll keys, switch algorithms, switch cert providers, etc.
LibreOffice and Calligra are not the only thing stopping the switch. For instance, smartcard support is big within the government, and while it can be done with enough effort on Linux, paying for "enough effort" would make the switch impractical almost by itself.

And it's not as if KDE 4 (or God forbid, GNOME 3) is so similar to Windows XP as to minimize retraining costs.
How would a less-aggressive tone be better at delivering the necessary info to Akamai and its customers?
I signed up for glass about a month ago, took less than a week to get my invite. Is availability even an issue? It seems like anyone who wants one (and has $1500) can get one easily.
Of course. If you can run code as the user, then solutions intended to protect against arbitrary memory read bugs don't apply.

That doesn't mean that the solution is worthless. It simply means that it doesn't cover an unrelated class of bugs.

Migrated to hardware-based tokens, or Intel SGX-protected software tokens, would extend the solution to cover the case of arbitrary code execution. That doesn't eliminate the value of the software-only solution.
>it feels strange calling it a "handicap"

I'm not sure why. If he could perform a better job, he wouldn't have been a grocery store bagger. That he has found himself there strongly suggests that his "handicap" affects his life in such a way as we might expect.
> really bad parts here too, like describing SOPA

Yep. I think any article that describes SOPA as merely "placin[ing] restrictions on the sale of pirated music and movies" is begging to be criticized, especially here on HN. It makes you wonder what else it gets wrong!

On the Post's SOPA point: First, it's been illegal to sell pirated works since the Copyright Act of 1790, as amended. Second, it's been a felony to distribute (as in, not selling but merely sharing) pirated works since the NET Act of 1998. Third, as far as I can tell, Google has no problem with those long-standing restrictions on the sale of pirated music and movies. Fourth, that "restrictions" language mischaracterizes the many unrelated problems with SOPA.

I can tell the Post put a lot of work into the article, and it was a good read, even though it buried the lede (Microsoft's PAC is larger), made factual errors (companies don't donate to PACs), missed a big reason Google was able to reach out to libertarian/conservative groups (it toned down its misguided lobbying for aggressive Net neutrality regs/laws), spent too much time on a conference barely distinguishable from dozens of others (organized by an academic center that had for years publicly disclosed it received funding from Google), and claimed that limiting government surveillance draws "unexpected bedfellows" (left-right pro-4A coalitions linking ACLU and conservatives date back at least 20 years).

Disclaimer: I know most of the folks interviewed in this article and spent a decade in DC. Fortunately I'm now in the SF bay area and doing something rather more productive. :)
This would be ideal. One of the problems with heartbleed has been that while you can revoke your cert and mint a new one, browsers don't check CRLs so they'll continue to trust the old compromised cert.

However, I don't think X.509 supports the concept of CA certs being limited to signing only subdomains (could be wrong), and you have a large industry that prefers the status quo of you having to pay them for each cert you mint.

This ends up with ridiculous things like tying payment to the lifetime of the certificate, which allows for things like "2 year certs", which are obviously less secure than 2×1 year certs.

But having your server roll it's cert every 12 hours from a more secure cert elsewhere would be a very nice feature.
So you want to make a video game?
How easy it is to hack the server itself really ranges from super simple to extremely hard. Is your target is a home server exposed to the internet, admin'ed by someone who installed apache from following online tutorials? Sure, you're better off just getting root access on the server. However, if your target is a server run by properly trained people who live and breath security practices, your best bet is to use a subtle bug in their stack that escaped their notice, extra bonus if it leaves no audit trail (e.g., heartbleed). I don't think this post is meant for an audience of the former group, but for those of the latter group.

I work at a pretty security conscious company (this might be an understatement, we're pretty big on security), and even as a developer on the inside I'd have to get pretty creative to get access to our production servers.
That's a reasonable reply, assuming you focus on that niche.

Have you thought about filing patents on your stuff, and licensing it to others who can bring it to market as a feature of selected items in their existing product lines?
Do We All Have a Little OCD?
>After reading your responses and claims of complexity and architecture, I don't think you understand PKCS#11, the problem domain, or the architectural constraints to a level that is commiserate with your expressed level of certainty.

I'm happy to learn. But all I am saying is that you're adding a PKCS#11 step to the call stack when you can just fork and use the existing code. That's a simple assertion, is it wrong?

>To be a bit more concrete, a forked daemon only needs to support RSA and other crypto operations without revealing their keying material. They don't need a full TLS/SSL stack.

I didn't say they did. I said that you had to implement some GnuTLS/OpenSSL code in apache to invoke the PKCS#11 operations, then implement your forking PKCS#11 driver that will then need to call GnuTLS/OpenSSL to do the crypto to return the PKCS#11 results.

>That said, there's absolutely no additional complexity in having both Apache and the hypothetical daemon using a full TLS/SSL crypto library. Any __TEXT pages will be shared, and duplicated __DATA and base-line library allocations are essentially zero.

The complexity I was referring to was in the code that you need to setup the call stack you are proposing. Obviously the gnutls/openssl .so will be shared.
For most white-collar professionals, very little is going to be gained by doing so. Drugs might help you grind out more hours, and they can give you confidence in your focus (the subjective sense of accomplishment is increased more than actual performance). Those drugs certainly make boredom less of an issue if you're at the bottom in a very demanding firm (e.g. an investment bank's analyst program). They're not going to make you better at politics, however.

Overperformance is far more dangerous to your career in a typical office job than underperformance. That's why the highs of a cyclic mood disorder like bipolar are more dangerous to one's employment than the lows. In a low, you underperform and might attract bad notice after a couple months. On a high, you work hard on something you weren't asked to do, it's brilliant, and then you get canned for (whether in fact or in appearance) neglecting your assigned work. Most white-collar workers are 25% depressed, chronically, by middle age and it doesn't hurt their ability to keep a job (although it's a disadvantage in interviews for new ones). It helps them fit in.

I'd say that it's worth using "smart drugs" for short bursts of work, or possibly in the creative professions if you don't answer to anyone. But most corporate workers don't need more "smart". They'd fare better with the opposite.
To be fair, most of the people I see with sheds with a load of tools in them don't make much and wouldn't know where to begin if they suddenly had to. It's the appearance of the thing that they love.
Stimulants = smart?
I would take, or at least would try, even if not required by job. And I would absolutely trust doctor or bus driver who takes the drugs, what could be the reason not to? Maybe I'd trust even more than non-takers, because with higher focus a driver, for example, would be less likely to go into accident.
What I heard about the MS antitrust case was that the judge lost his temper because Microsoft was being petulant and uncooperative, giving Microsoft an excuse to have him replaced by someone who wouldn't break up the company.
What is "enforcement" budget?
Highlight the Web

A browser plugin that lets me highlight text on a web page. I can view other user's highlights on that same webpage, and see my highlights again when I revisit the web page weeks later.
There are a bunch of comments about rolling your own scraper instead of relying upon a possibly unreliable SaaS app.

That makes me think -- would it be viable to run a service that, instead of running the scraping on their own servers, simply gave you a custom binary to run?

Assuming that you trusted the executable, you would never have to worry about the company failing. It'd just be a one-time fee, and yours to use in perpetuity. Presumably updates would be free.
I wrote http://scrape.ly if you wanna have a look, it's a url-based API for web scraping.
DMAE. Went through FDA testing a long time ago and was so safe and effective they made it over the counter.

I don't use it more than a month a year, though. I just don't believe that lunch is free.
> I'm happy to learn. But all I am saying is that you're adding a PKCS#11 step to the call stack when you can just fork and use the existing code. That's a simple assertion, is it wrong?

Yes, that's wrong. What existing code is there that provides an IPC mechanism for offloading RSA signing operations that are done within the TLS libraries themselves?
Oh but if you do that how are you going to make a pretentious critic to shoot it down ? The akamai guy straight up said "that's not actually our code, and that should not and cannot be used as-is, this is a POC", rendering this entire "answer" irrelevant especially given its mocking tone.
My understanding is that is actually "Crony Capitalism", which then if the article redefined it as such, I would agree.
So you both are re-appropriating someone else's trademark.
Some professions could go the way pro-cycling has been for much of its history: you have to take the drugs to just keep up with everyone else.

If we assume 'miracle drugs' with no side-effects then there is the small matter of money. Drugs are expensive, market forces tends to keep it that way. So, to be a 'rockstar programmer' you might have to fork out $100K a year in pills, therefore making entry into 'the sport' cost prohibitive to outsiders that aren't on the drugs and able to ride with 'the pack'. Lance Armstrong and co. were selling their sponsor provided bikes on eBay to pay for the pills and riding old bikes, things got so desperate for the drugs slush-fund.

Even if we assume legal status for pills (so they don't have to be paid for with unaccounted funds) and affordable pills (supply exceeds demand), the money spent on pills means money not spent on other things such as the mortgage, the pension fund, fruit and vegetables etc.
I am happy this product has convinced you :). And yes I have already got the patent pending status for it :).
Not sure if you're the one who changed it, but the " Trapperkeeper is a new Clojure framework [...]" title works fine and is much less misleading imho.
Apparently, he is not competent enough to understand what "this is not our actual code but merely a POC" means.
How To Survive An Internet Apocalypse
Yes. It's not really fair of the OP to say "this is broken in totally obvious ways and would clearly not actually run" and yet critique it as if it was production code. It's fairly obviously (at this point) a hand-constructed pseudo-diff.
Your bio says you live in Texas and are the founder of the art website www.wysp.ws.

Let's say a congresscritter introduces a bill in the U.S. Congress requiring art websites to verify the age of their users so Junior can't access DeviantART or somesuch. "WE MUST DO IT FOR THE CHILDREN! THINK OF THE CHILDREN!" intones Rep. Deanna DeGatte (D-Colo.) on the floor of the House of Representatives, and then the president says he thinks it's a good idea.

If you hire your college buddy who now works in DC and regularly goes drinking with DeGatte's chief of staff, because this stupid law would put you out of business, is it lobbying or corruption? Or is corruption when mainstream art galleries, who are facing Internet corruption, hosted a fundraiser for DeGatte, and then she introduced her bill a day later?

Hint: Consider the difference between offensive and defensive lobbying.
1) Good lobbying: Google lobbies congress to allow self driving cars in all 50 states. result: good because its asking for permission not taxpayer handouts, consumers pay the entity through supply and demand not taxes

2) Grey area lobbying: Light rail manufacturers lobbied congress to increase federal spending to help with light rail projects across America. result: uses taxpayer dollars, might increase light rail projects in areas where it isn't needed, takes tax payer dollars and transfers them to the entity doing the lobbying

3) Bad lobbying: Chrysler, GM, & Ford lobbied congress to lower the fuel efficiency standard (MPG) and prevent increases. result: screwed themselves over because in the long run they could no longer compete fuel consumption wise with foreign auto makers and had to be bailed out

Most people don't understand that lobbying is a tool. It can be used to enact laws that benefit or hurt different groups of people. It's more talked about when it does bad so people assume all lobbying is bad. Same with "bacteria", "fat" and "cholesterol".
I don't think I've worked anywhere where there was a simple way to switch cloud providers with the push of a button. Even migrating to different locations within a cloud provider isn't trivial. You'd have to invest a lot of engineering time from the beginning to get this kind of capability, and you may never realize any value for all the pain.