skysight-inc/HackerNews huggingface dataset:
Nobody caught this bug over two years (supposedly). Stranger things have happened.

Also, while the NSA might have wanted to create this bug to exploit it, you still haven't shown that they created this bug. They might have known about it and exploited it, but saying they put the bug in the first place is a very strong claim.
Is your bible the inerrant word of your god? If not then does it have any legitimacy? Is homosexuality a sin?

I have yet to find someone like you who who at some point does not admit they are anti-gay. They say they are not, and then you find out they are due to holding two contradictory views at once. Even then you've never given money to any church than ones you know for a fact are 100% not anti-gay, have no one in power who is not anti-gay? That is the parallel.
That's the fun thing about most religious folks. They pick and choose which parts of <HOLY BOOK> to follow. Not to pick on anyone in particular, but ever heard the term "Cafeteria Christianity"[0]? It seems that following the entirety of a religion would be rather hard unless you quickly dive into the sticky situation of saying which parts are valid and which are not.

[0] - http://en.wikipedia.org/wiki/Cafeteria_Christianity
> The (generally correct) mindset is don't implement your own crypto

That sounds like bad advice. The huge impact of Heartbleed is precisely because of the monoculture in SSL/TLS implementations. Shit happens but this vulnerability is such a catastrophe because an estimated half a million of the top Internet websites have been vulnerable since 2012, including popular services that everybody is using and the vulnerability once discovered, is easy to use and far reaching, allowing one to steal sessions, passwords, the domain's private keys and anything important.

It really can't get any worse than this. At the very least we found out about it, better late than never and we can discuss the source-code, but it does make one wonder ... if SSL/TLS is such an important piece of infrastructure and if we need a monoculture (because apparently it's bad advice to reimplement crypto), why aren't we using a library that's the reference and that's peer reviewed by a standards committee, instead of relying on a library for which commits don't necessarily trigger sounds?
I don't think you understand the nature of the problem if you think no action by customers was required.

I think the response from amazon was fine and they are clearly not amateurs technically, communication was very poor.
No, you're right on target. They are using non-optimized data structures, and rely on (Bouncy Castle's) managed code for encryption. From their paper, the throughput is around 10x slower than OpenSSL (but much closer to JSSE). My guess is that one could probably speed this up significantly, while still retaining the guarantees, but that's probably less interesting to these guys.

As for Mono or .NET, I assume so (AFAIK that's the only way to run F# applications).
^ this!

back in 2010, my business partner, marco peereboom, submitted a patch to openssl to add support for aes-xts. it was coded by joel sing, now a google employee and golang dev. they _didn't even respond to the mailing list email_ and after marco nagged for a reply the response was "we have a different plan for how to implement XTS" (i'm paraphrasing). _2 years later_, they added XTS support.

the openssl dev team is not responsive, doesn't accept contributions and generally speaking suffers from "you're not an expert" syndrome. look how expertly they've managed their project!
Yes, but it's not reasonable to assume that our armchair "how I would do it" theorizing is, in fact, how they would do it. We can assume that they have come up with the idea, but maybe they discarded it for reasons that aren't obvious to us.
Actually, they had to re-key their certificates. They did have work to do, and they couldn't do it till the upgrades at AWS was done.

So yeah, you'd be still having a bad day. Because you have no team 'o dudes on standby, so your already busy staff are chaffing at the bit to get the certificates sorted out, and potentially not being able to restore service and constantly checking to see Amazon has completed their patching. i.e. little to no productive work is being done.
RFC 6520 is the Heartbeat specification, right? Design notwithstanding, is it really an unbelievable scenario that the person who wrote the RFC also implemented it?

The bug was a typical C slip-up. You see it everywhere. It happens. Yes, the stakes are much higher here, but I don't think the fact that Robin also authored RFC 6520 makes it more suspicious.
Ask HN: Instead of Finding a Cofounder, find a Startup to Merge with?
I've been searching for a cofounder for a while, but it seems the best developers aren't looking to join another startup since they're working on their own.

Would it make more sense for solo-founders to search for other solo or small startups to merge with instead of looking for 'available' cofounders?

In case people are interested in this, I created a google form for signups: http://startupmerge.com
Wow, someone who takes anything to do with w3schools seriously ;-)
The reason people in my country are poor is because of the government's economic policy. India is a very resource rich country otherwise. The country still recovering from its earlier backward economic policies [1].

[1] http://en.wikipedia.org/wiki/Economic_liberalisation_in_Indi...
JetBrains April 2014 Newsletter – IntelliJ IDEA 13.1 and Java 8, WebStorm 8...
If you feel insulted maybe it's because you are a fanboy yourself ?

I agree it could be clearer, but insulted, really ?
More than "none", at least. My main machine is a Thinkpad T430s running Arch, and no matter how many times I've tried to flip over to a Mac, I don't like it and come back to Linux.

Still have a MBP because I need to port software to it, but my day-to-day ops are on my Thinkpad.
Here's the link: http://startupmerge.com
The Design and Implementation of the FreeBSD Operating System gets updated
I don't think the NSA had to create this bug. I do think that static analysis could find this bug, and if they did not have the static analysis tools to do so, they probably will soon enough. It is far better for them to find existing bugs than introduce new ones, because the former is untraceable. The latter, inevitably, leaves a paper trail. I'd need a lot of convincing to believe that OpenSSL is so darned secure that it has no bugs in it until the NSA adds them, just based on the software engineering practices of the product (using C, little test code, etc).
Agreed. I'm seeing a lot of people here saying "The service is great - we didn't have to do anything!". Sure hope someone tells those people to re-key their certificates at some point.
Hopefully, this helps to get more Mac software of the second class citizen list. Microsoft has traditionally lagged with support in Office. Recently, I wanted to buy Dragon Naturally Speaking for my Mac but it's missing the Python support, which I wanted to use to automate to of my work.
Are Macs expensive in your country/city, related to PC?

I bought my first iMac one month ago, after using HP, Acer, etc. w/ Slackware for years.

Would like to acquire a Macbook Pro soon, just to give you an idea, a Macbook Pro, i7, 16 GB RAM, SSD 512 GB is around 2900 U$ here.
I know.

Sadly this page is not updated often enough.
I mean, when there's a known issue on one of the aws service this page display a little "i" icon, which is barely visible.

And when, you encounter some problem with your AWS stuff that clearly come from their side, if the problem it's not wide, they just say nothing. At that point you can search yourself for hour to be sure it's not your responsibility, and after-woods, you just wait, blind.
North Korean refugee co-hosts English talk show
I’m talking to you, Stackoverflow. I use Ctrl-k, Ctrl-b quite often.
Response to having a space program while having poverty: http://balajiviswanathan.quora.com/Indian-Space-Mission-Pove...

Please scroll down a bit because the awesome part comes after the subhead: Why India needs a MARS program.
Well, I can code myself out of a hole I have coded myself into. But I guess the world is a better place because I don't try to help crypto projects by contributing.
I don't think lying is good advice for anything. No one wants to live a lie and word can travel fast and ruin this guys credibility depending on the industry he wants to get into.
So you pay for revocation of certificates twice. The first time you revoked the certicates, someone could have compromised them immediately afterwards. How is that a good solutions?
BTW, I remember from the CloudFlare blog that they were notified in advance of the bug and had already patched it. How come big names like AWS and Heroku did not get this prior information? Who decides on which companies hear it before the public does?

From the Cloudflare blog: "This bug fix is a successful example of what is called responsible disclosure. Instead of disclosing the vulnerability to the public right away, the people notified of the problem tracked down the appropriate stakeholders and gave them a chance to fix the vulnerability before it went public."

-- http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerab...
Memory safety in C is hard, but this bug, a memcpy with a user-supplied, unchecked length? I mean this is stuff that I learned about in my first serious class that involved C, and it wasn't even security related. C is a language where you code defensively at almost all times, yet this was ignored in the SSL implementation, a project which is based around communicating with a user? This is the situation where you really can't trust things like lengths. Either its incompetence or shilling, both of which are harrowing.
Based on some informal research I did ~10 years ago (i.e. I ready the LGPL as a high school student), the LGPL requires, among other things, an end-user license allowing reverse engineering. The LGPL isn't just "my code is GPL, the rest of the program is whatever"; it puts forth some requirements for the entire finished product that are either impractical (must include source code) or illegal (would violate NDA or other license terms for the console libraries) for console games.
We Just launched our customer management tool for small biz. Need testers 
We're a small team of 5 at the Atlanta Tech Village. We just launched our product! We're now starting to get off the ground but we would love your feedback. Check us out www.sherpadesk.com & let us know your thoughts.<p>Here is a free 6-month pass. It's on the house. Tweet us @SherpaDesk and let us know your org/biz name and we will make sure we take care of you!
Yea, I like physical books too, but I have wasted hours on
figuring out code examples with typos.
Mozilla Matters
Well the odds are non-zero. If you're worried about intelligence agencies harvesting your private keys, any odds above 0 is close to 1.
> I am just unable to comprehend how a nation can at the same time fly to Mars and have a large part of their population live in slums.

It's a matter of priorities. Nations seem to want to spend money on looking impressive and technologically advanced to other nations and place that as a higher priority than their own citizens. Historically, space programs are also used to remind their neighbors that 'hey, we can put a robot in orbit of a rock millions of miles away, we can sure as hell put a bomb on your door step.' That's who they're trying to impress and what they're trying to drive home.

Fuck the poor seems to be something of a universal position.
And while you're at it- definitely disable every possible autorun option.
They managed to do everything they could without customer involvement. The rest (retiring keys and stuff) can not be handled by them due to nature of the problem.

Now that the technical issue has been resolved by other smart people, I'm gonna replace our cert keys and be just fine.
Frosting Glass with CSS Filters
A better looking 2048 + improved performance on the mobile phones.
I'm not totally convinced that they even knew about it. If they had known about it, why bother going to the courts to coerce Lavabit to give up their SSL keys?
May I present the Metropolitan Community Church:

http://en.wikipedia.org/wiki/Metropolitan_Community_Church

And i've not been keeping a list or anything, but plenty of churches in my part of the world have rainbow flag stickers on their signs/noticeboards.

I went to watch the local Pride parade a few years ago and was bored by the number of churches marching in the parade. (It's great that you're actively showing your support, but at least put some effort in to do something fun during the parade. Sheesh!)
Heh, somehow, I ended up with -3 points. Anyway, according to the victim's blog, "The major twist to this story was the thief was actually a male."
Find someone who has proposals on health-care you like but not the wanton drone attacks? Or if there are none like that, then start to campaign yourself to get elected? Also, being a friend with a person from a small town who has prejudice against someone is very different than who you elect the President of the USA.
What Heartbleed Can Teach The OSS Community About Marketing
I'm not aware of any long form text on this, but the issue is relatively straightforward.

A publisher hires a studio to make a game, which then gets published on platforms that actively prevent users from (compiling and) running their own software (consoles, iOS).

Since the user is not provided with the tools to replace a library used in a game, the terms of the LGPL cannot be met even if the studio were to release the source to their version of the library.

In fact, even if they released the source to their whole game (something the publisher would never allow) the LGPLv3 still cannot be met because of the anti-Tivoisation clause, which stipulates that users must be able to run their own compiled version of the software.
What are you talking about?

I'm your hard pressed example that has never given money to a church.

I also support true equality: the complete removal of any government involvement in marriage. All consenting adults should be able to get married without any government permission or regulation. No future group of persons should have to ask the government for permission to exercise the rights that do not belong to the government to begin with. If the government believes it gives you such rights, some future politician will find it all too easy to believe they have a right to revoke them.
Security Update: We’re going to log everyone out today, here’s why
If the NSA is all knowing as everybody seems to think, why aren't all criminals in jail by now?
That is a very simplistic and uninformed view. He does not compare the cost of electronics, gas, automobiles or even other exotic foods. Each of these cost more in India than they do in USA. One has to consider how much of the costs of the mission are actually spent on paying salaries compared to purchasing & building the equipment needed for the mission.

The actual answer may have something to do with the fact that India did not spend a lot of money on R&D specifically for the Mars mission. They are leveraging existing technologies and knowledge from earlier missions (including some from NASA and ESA).
> If I voted for Mitt Romney because of his tax proposals, does that mean I support...well, his likely use of wanton drone attacks?

If you like someone as a CEO because of their leadership qualities, does it also mean that you support their stance on gay rights, though?
So if I have a site that doesn't use SSL, am I still affected? I'm still trying to make sense of all of this.
Eh.. supporting an anti Jew law is way different than supporting Hitler too, I mean, just because someone doesn't like Jews and they want an extermination law doesn't mean they want Hitler to do it. I can't believe people can't see this blatant logic.
It's possible it was a message which didn't go to every node.
I point it out as a counter to the tempting narrative of rational economic thinking versus compassion.
"terminal ballistic instability" - interesting. All we were told is that these bullets can do so much damage, that even hitting a foot at close range can easily kill someone, so we had to be extra careful when handling the weapon. Most of the soldiers who don't have an explicit infantry role mostly train at long range target shooting (400m). Also, each year soldiers need to go do their 'mandatory shooting' - 10 rounds at 300m with some required precision. So I think you're right about long distance precision being the most important requirement for Swiss army rifles - probably makes sense assuming a purely defensive stance.

The way I see an ideal Swiss army would be a concentration on locally organized Guerilla forces anyway - heavy tanks and artillery could be completely canceled and the airforce could be reduced to a pure air police. In a hypothetical war against a big nation, air superiority would be lost in probably less than a day, which immediately renders stationary forces and tanks useless - but the biggest asset we would have is precisely those bunkers and 500k rifles in the hands of people that are well enough trained at distance shooting. All that would be needed is a difficult-to-suppress way of communication. For that matter I'd issue a new kind of radio device to all households and include it in a new law. Let these radios create an encrypted ad-hoc network with frequency hopping and lots of random noise on unused channels. Make the software and hardware Open Source and cheap, such that a) they can be improved by the community and b) can be used by oppressed people in other parts of the world. Then we could wish any future agressive foreign government much fun at financing a long drawn out oppressive war against a mountainous country with 8M bunkers, 4M radios and 0.5M rifles - with all useful bridges and tunnels gone ;-).
Symbol's puzzle arcade game
Hi,
I would like to present to you my first game on iOS. Enjoy.
Check out https://github.com/CanCanCommunity/cancancan, the continuation of the cancan gem.
To account for out-of-order packets, apparently (TLS-over-UDP is something I've never heard of, but I guess it exists?)
So you would vote for the President of the United States when he was not in support of gay marriage, and that's OK, but if the new CEO of Mozilla holds the same stance you will?

Don't think I've seen Obama apologizing for his past stances on gay marriage. What's the difference again?
The How Hypocritical Are You? Test
List of Topics for programming Competitions
Quite frankly this falls under the great category of "why didn't I think of that". I like this idea and the website is beautiful. Please make with the mobile app that automatically provides directions to the job you applied for on the website. Well done you guys.
Isn't it a better idea to manage your dev & prod environments using the same configuration management tools so that it's easier to synchronize them? Bowery doesn't seem to have great support for production environments.
My rationale was always "I can run Windows on a Macbook, but not the other way around, and what if I ever need to write an iPhone app?"

Plus, trying to get Apache configured on a Windows box, and then transferring that knowledge to a Linux machine in the cloud somewhere, and wondering why everything breaks when you put it on production is really frustrating. (The first time you run into this, it's usually case-sensitive filenames...) Cygwin and MinGW can mitigate this, but add an additional level of complexity that really begs you to just run Ubuntu in a VM or buy a Macbook.

I think the more common thing is that if you are financially secure enough to quit your day job for four months, you probably have enough saved up to buy a Macbook or top-of-the-line Thinkpad. If you have a $500 netbook and you're in a co-working space, waiting for your computer to compile things might not be the most effective use of your time.
it sounds so easy when you break it out like that but it is a considerable investment of time and money. Convincing people to spend either of those on refactoring vs adding new features is a constant battle. No one ever really understands it and typically responds with "you want to go back and do what you already did, just differently?"
There are certainly large commercial entities who have sufficient incentive to keep OpenSSL secure that they really ought to be contributing actively to the project; I wonder whether Amazon might step up given how badly (and publicly - witness Mojang's taking minecraft services offline and pointing the finger at Amazon as the vendor they were waiting on to fix things - https://twitter.com/notch/status/453529143121309696) they got bitten by this vulnerability. Cloud hosting companies clearly have a responsibility to deliver trustworthy services, and that means they need to be deploying software stacks they can rely on not to screw them; either they will need to step up and support OpenSSL or switch to different SSL solutions that have stronger guarantees. Network appliance vendors like F5 and Cisco also have a clear interest in fixing this stuff. Question is, will they?

(disclosure - I work for IBM, though not in cloud infrastructure. What I say for Amazon applies to our cloud services guys too.)
If I were handed a few million dollars and told to go create an SSL implementation, my approach would be to write the implementation in Haskell in a way that compiles down to LLVM or, possibly, assembler, which is then what the project would distribute. Haskell's type system can be used for all the juicy goodness being described in the other comments, but it would not be running in the Haskell runtime. See: http://hackage.haskell.org/package/atom which goes to C; in principle it's not hard to imagine then how you'd go to another target.

There's two reasons for this... first, a pure-Haskell solution locks it to Haskell only, as there's very little realistic chance of embedding Haskell in any other environment. Having it compile to something like straight assembler or LLVM means that we can almost certainly wrap that in almost any runtime environment effectively. (We might require a bit of new SWIG-like tech to do it, but under the circumstances it would probably be worth it.) To the extent that's not a true statement, imagine that I will research and find the correct level of abstraction. (Maybe it really is C.)

Second, with all due respect to the Haskell runtimes in the world, it's just too big a surface to secure. People are asserting here in this thread that you could avoid side-channel attacks in the Haskell runtime, but how would you prove that? To any degree?

Theoretically, you might be even better off in a real proof language, but it's not clear to me that any of them have a good enough extraction-to-LLVM/assembler story.

This would, in theory, produce a solution that should be embeddable in nearly any other language, and indeed, even in embedded environments, while still leveraging the strengths of Haskell's expressiveness and type safety to build a very safety-critical library. We would also be able to write some powerful tests to verify that the putative time-invariant operations really are time-invariant. My strong suspicion is that we'd discover some processor differences here that would surprise everybody.
No work emails after 6PM in France
The "I Whipped Spider-Man's Ass" of operating systems :)
Use a social bookmark ? Or organize your Browser bookmarks ?
i disagree because slavery in "ancient times" came in all shapes and sizes.
I think we can safely stop thinking about the morality and legality of our actions, as long as we just apologize regularly.

Here we have two people who have both performed actions which are both indirectly anti-gay. But one is let go due to an apology, and the other wasn't due to no apology.

Apologizing is like a mark-and-sweep garbage collection approach to our past perceived sins.

Accountability (and reference counting) is boring and takes a lot of resources.

So we should just apologize.

BTW, I apologize for everything.

I also sincerely apologize for this post. Forgive me.