skysight-inc/HackerNews huggingface dataset:
There isn't much physics simulation besides direct user-induced velocity modification (or macro'd velocity modification, e.g, orbit-at-n-kilometers). It's not like they're calculating n-body gravity here.
Hi, one of the antitude devs here.

I really don't think it's very run of the mill. We tried to take decentralisation as far as we could, which I don't think many other architectures do. We also tried to make it simple to deploy and put together new web apps.

The code we have is very much a prototype that just about manages to convey where we are hoping to go.
"Polar vortex" has been in the lexicon of meteorologist for decades now.
If by nodding, you mean nodding out. For some reason, they've specially crippled the '/' search, and removed the configuration variable to make it identical to ctrl-f (next/last arrows mostly.)

If you happen to read this and are irritated by the same thing: I was saved by "Findbar Tweak." New essential plugin for me.
Well, doesn't the majority of us have some kind of side-projects? If I had a good coworking space nearby, I'd head there after work too, instead of trying to anything at home.
It's been a long way, but it was really worth the wait!
I tried to comment on the blog with something about a time stamp is all you need for the general case (and maybe some urls giving more information about the situation).

Patched: 0 and Vuln: 1 isn't really useful information for the user; if sensitive data is involved the site should take itself offline, not warn users. A time stamp indicating when a mess was resolved is all a user who cares needs to decide to create a new password.
I'm intrigued by "full iOS support." Does this mean it's now possible to write iOS apps using a Haskell backend?
The Samsung Gear 2 Smartwatch Is Surprisingly Repairable
Create Your Own J.A.R.V.I.S. Using Jasper
Definitely proof-of-concept at this stage!
I agree, I've also been at a company which merged with another company; and both were each using their own Jira and Confluence instances along with plugins. Horrible products.
Simple Threading and Serial User Interface library for the Arduino
Google was one of the discoverers. From the page:

...independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon and Neel Mehta of Google Security
Of all the problems we have, server-side adoption in the face of serious security flaws is not one of them.

The marketing is just confusing people, and patio11's advocacy for more irresponsible marketing-focused disclosure is self-promotional, ambulance chasing, and irresponsible in the extreme.

Small ecommerce owner gets OpenSSL from their hosting vendor. Lazy sysadmin is running 'apt-get update' && 'apt-get install', and if he's not, there are 50 other serious vulnerabilities he's open to anyway.
Why would you configure Apache on a Windows box? Just set it up in a Linux VM. VMs work in Windows just fine. And Windows laptops with comparable specs to a MBP can be had for cheaper (for the most part).

Still, I love the hardware of my rMBP. It barely takes up space in my backpack, keyboard is good, don't have to worry about breaking out a mouse because of trackpad, battery life is good enough I often forget to charge it, etc.

I prefer Windows 7 to OS X, but in general I avoid setting up things that should be best done in Linux on either platform, VMs are good enough for most of that.
Moot Rebrands As Muut, Raises $770K To Make Online Forums Less Ugly
Not clear at the moment. We're open to suggestions and partnerships!
> Man, would that have been an easier month if
> we had all been talking about DeserialKiller.

Cereal Thief (I like a bit of whimsy; and as a child, it was serious :-)

Serial Killer (Yeah, drops the "De", but more people will associate with it, and it's easier to parse and pronounce.)
The lower you are on the stack, the more you need quality. And the more you need quality, the more likely you are to run into hackers with 'tough love' personalities, because they simply cannot tolerate poor excuses for code.

How they express it is a reflection of their character, but they will let you know when you screw up. Theo was extremely tact given the enormous impact of this bug.
Yah just what we need more *.txt files in the root of your website!
Basically, make everything easier for script kiddies by decreasing the amount of time they take to scan a host for the vulnerability.
Weighting the pros and cons... the cons completely crush this idea.
OpenSSL’s bleeding heart
Toyota is becoming more efficient by replacing robots with humans
Giving Away Our Recommendation Engine
Is that really bigger? Heartbleed meant that I, sitting comfortably in my home, could hit up yahoo.com and grab your credentials without being anywhere near your computer, or any of the data your computer sends or receives.

Password in the URL with unencrypted HTTP is colossally dumb, but at least I have to either access your computer or at least snoop on its connection to take advantage of it.
Arvados – Open source bioinformatics platform for genomics
One of the Steroids devs here.

Nice job, Marc. Your thoughts on the subject are much appreciated. Thanks for your kind words on the tutorials!

As for the pain points you had along the way - we feel you and are working toward improving the development experience. Rest assured that the amount of assorted tricks you need to learn to develop a premium application with Steroids will be going down.

The project file structure will be improved to make it easier to tell what parts an app consists of. The focus will be on presenting Angular modules as units of functionality. We find that dealing with preloaded views is cumbersome at the moment, and view handling altogether is ripe for a bit of restructuring.

We also believe that there could be more approachable ways for reacting to eg. the application resume event you mentioned, and for communicating between views. An application that consists of several views each running their own JS environment gets surprisingly tricky to get right, and is not a problem you would prefer to be solving when trying to get your app idea off the ground. For instance, you want to have a bit of data that's persisted to localStorage but that gets rendered to multiple views; in this case you'll want to notify the other views in case any changes occur. Currently, implementing this behaviour must be done essentially manually by our users. Steroids Add-ons implements a few measures to improve the situation behind the curtains, but we don't have something to offer everyone at the moment. For this, and for other use cases where you need to deal with asynchronous and non-local data access, we're brewing solutions right now.

Thanks for the valuable feedback. _b
Don't get me wrong, I think that heavy mobile forces have been very valid in WW2 - I just think that nowadays they don't make much sense anymore, and the main reason is a) today's intelligence capabilities that make everything big very hard to hide, b) air-to-air capabilities of big nations that are impossible to match for a country like Switzerland and c) the efficiency of air-to-ground bombing. Basically, you can have as many tanks and artillery defenses as you want, as long as you can't keep either air superiority or intelligence superiority, they're useless - and as far as I can tell, in both those areas you can forget holding up against a power like, say, Russia. On the other hand hundreds of thousands, up to 1M, resistance fighters in urban or woods territory with sufficient Demo, RPGs, good rifles and ammunition - it becomes a huge numbers game to fight this. The USA are basically the only nation that has become efficient at dealing with this sort of situation, and even then there's no end in sight in the Afghan conflict for example. That's why I think a guerilla army that has been trained at this, for everyone to see, is a much bigger deterrent than heavy machinery - and it also takes much longer to be outdated.
Yeah I think it misses some moves based on the timing loop
How I hacked Unbounce to make better landing pages.
> The announcement isn't for technical folks.

It's not for non-technical folks, either, because there's nothing they can possibly do other than be confused.

It's empty self-promoting marketing that sent the entire industry scrambling.
Hm. I'll start looking into this if this could be turned into a general crypto/SSL/TSL-cross verification service. I'd need to wrap the various components of libraries into sandboxed REST-like webservices to enable more languages to take part and then I'd need some system to just generate semi-structured junk to throw at those implementations.
Cool. Another of my jobs at GE AstroSpace involved writing software to help with the analysis of thermal system modeling. At its heart, thermal modeling is basically the same as one of the approaches for lighting models for 3D graphics: every surface within the spacecraft is radiating and absorbing heat from every other surface that it faces. This is similar to the way every surface in a 3D model visualization is emitting, reflecting, and absorbing various frequencies of light from every other surface it faces in the model.

The math is the same, but in the thermal model you're calculating an equilibrium state to figure out the final temperature of each surface, or cyclic variation in the case of a rotating spacecraft with the sun and other emitting bodies around it. That tells you if temperatures are within the tolerance range of the components over the mission lifetime. If not, you have to add thermal protection and rerun the simulation.

This probably all goes a lot faster today than it did on the 1990's era VAX minicomputer I was using. There's probably real-time visualization now, which I'll bet is pretty cool.
> So he was not in any way neutral on this issue. It is impossible to argue.

I am not arguing that he was neutral, I am arguing -- as is manifestly and unquestionably the case -- that he was on the opposite side of Eich. He specifically condemned Prop 8 and similar measures.

The fact that that opposition was in spite of the fact that he very publicly stated that he shared some of the moral beliefs that others claimed made support of Prop 8 necessary, if anything, underlines his opposition, rather than mitigates it, as his position was that Prop 8 (and similar measures to enshrine a man-woman definition of marriage in Constitutions) were wrong in the then-current environment even given the moral belief that marriage ought to be between a man and a woman.
> We believe the reason is that, while allowing higher interest improved the financial attraction of lending with Zidisha, it simultaneously weakened its humanitarian appeal.

As someone who donates money to 501(c)3s that are focused on the developing world and who also dabbles in P2P lending, I see a disconnect. There's nothing magical about a 10% APR figure. Maybe it feels better to some folks, but for me personally at least, if I'm looking for "humanitarian appeal", I would far prefer to donate money than lend.

The blog states "higher interest rates do not seem to have resulted in higher levels of loan funding overall." This is an interesting statement. It could mean one of two things: Zidisha lenders are not actually interested in lending and are going to allocate capital regardless of risk, or the higher interest rates aren't high enough to attract capital to the theoretically riskiest borrowers. Without more data answering the question "Why?", it's premature to use this as justification for capping interest rates.
This makes me feel good. Because once I adjusted the salary for living in NYC I am still above the average.
No Personal Data Is Safe From This Drone's Stalking Capabilities
CFP open for Polyglot Conf in SF
Because they're not the police. And the jails are already full.
This is pretty timely, I tried and failed to get into Chapter 2 of SICP just a few months ago and eventually got discouraged and ran out of steam. I signed up for this, maybe it'll help keep me accountable and on track.
Interestingly enough, MtGox did this as well in the very early (pre-alpha) days of its role as a Bitcoin exchange.

Its developers were summarily bashed for this practice when seeking feedback (and rightly so).
According to a Dice analysis of data from the U.S. Bureau of Labor Statistics, the average hourly salary for tech consultants hit...

TLDR==> the data lacks suitable specificity to be interesting
Check again. Hint: "abort()" is not "return" -- that code doesn't prevent you from having to know how large the buffer is, it just shoots your program in the head if you don't. Which is basically the same semantics Java et al have by throwing an out of bounds exception when you don't catch it.

Incidentally, this is another reason that the language can't save you from yourself. Program termination is sometimes totally unreasonable, e.g. in real-time settings. And it's unreasonable regardless of the language. When an airplane falls out of the sky, you don't get to declare victory just because the reason it did was an uncaught out of bounds exception rather than a buffer overrun. In that context the programmer must explicitly handle the condition that the buffer is too small, regardless of the language, because "abnormal program termination" is not an acceptable outcome.
http://blog.kamens.us/heartbleed.txt

If you are going to propose something, why wouldn't you implement it.
AWS WorkSpaces on iPad – DaaS
My apologies, I accidentally downvoted this. I strongly agree -- this should have NOT been publicly marketed in this way until vendors had some to assembly updates, and possibly not even then.

Serious security vulnerabilities do their own marketing for the people that need to know about them.

This is just lowering security to the tabloid level for mass consumption by users who can't fix the issue anyway.
This isn't the first article I've seen on this and they all seem to imply that something unscrupulous is going on because some doctors make so much from medicare. In some cases there probably is but is data on total payments received alone enough to tell people anything meaningful?

I would think you would also need to know what their percentage of elderly patients were vs. private insurance patients. You would also need some measure of their operating costs. Absent that kind of information this seems only useful as a political tool to plant the idea in people's minds that hey these doctors make a lot of money and some of it might be fraudulent.
I see... I don't know about IPOs but companies like Rovio (Angry Birds) have reached household name status. (Not the name "Rovio" but Angry Birds rather).
That's why it's so vital for everyone to implement Perfect Forward Secrecy. Yes, it's a little late for that now in regards to this bug, but who knows what others bugs like this will be discovered in the future. Let's at least not make the same mistake twice, by not taking advantage of PFS, which could've prevented most of the damage from Heartbleed.
Wouldn't this only apply to neural networks as used for classification? I mean the general paradigm of deforming curves until they're separated by a hyperplane seems pretty obvious now that I see it in front of me, but what about neural networks used to approximate continuous functions?
> sorry their updates weren't to your liking but...

Folks, this is an account created 19 hours ago making half an apology and then rationalizing not listening to customers because they solved a "big" problem quickly. That's an ad hominum argument and as a result, a big tell on intent.

From my perspective, pushing out a new SSL build to a bunch of load balancers in a highly automated network like AWS is probably, by this point, a trivial task. Actually listening to the customer and responding decently is MUCH harder. Clearly it could be done better, which is the point of the post.

Rise above getting offended/scared about being called "amateurs" and start talking more about what goes on in that creepy black box that is AWS. You owe the world that much, at the very least.
Believe it or not, it's still possible to buy brand-new x86_64 Windows laptops that don't support VT-x or AMD-V. Pure-software VMs are still unbearably slow for development.

Plus, people will use what they're familiar with. I see first-year students trying to set up gcc on Windows all the time (because the first-year assignments in my program are written in C; other programs here use Dr. Racket or C#) and it doesn't always end well. I did manage to get Apache set up on Windows back in the early 2000s and at the time it was less effort than setting up dual-boot (but only by a very small margin).
Maybe the payload is used for a sequential id number?
Assuming it has something to do with this[0] but I'd be interested to know as well.

[0]: https://ghc.haskell.org/trac/ghc/wiki/Building/CrossCompilin...
Work That You Love
http://en.wikipedia.org/wiki/Hanlon's_razor

This bug is too general and too wide open to be deliberate. Any college student could write code this shitty. An engineered flaw would have to be more subtle.
A useful alternative could be for password managers to periodically (and on creation) check ssl certs, store them, and then check for revocation (periodically or on demand). That would be general, useful (I guess) and it would not require any new standard.
I've no objection to configurability, but I don't want slash to behave the same as ctrl-f. In particular, when my /-search matches part of a link, hitting return follows the link. Ctrl-f searches for next, which functionality I already have access to with ctrl-g.

Edited to add - how can you stand the lack of next/last arrows in vim?
If you're worth your salt, you can get more than $42. I don't really know what else to say.
I am curious about that one opthalmologist who made $21m in a single year from Medicare alone. That's top hedge fund manager or Fortune 500 CEO territory...

Is it possible that this is a businessman with many clinics collecting payments in his name, or is that really one individual who somehow billed this much?
5 Tech Job-Hunting Tips for Returning Veterans
Communication of the vulnerability was mind-bogglingly bad - knowledge of its existence became widespread well before major distros had patches ready - but the fact remains our servers were vulnerable (and had been vulnerable for a very long time) and needed to be patched ASAP. We must err on the side of caution and consider everyone that should not know of the vulnerability was already fully aware of it and capable of exploiting it.

The same arrogance that makes someone think they are the first to uncover an exploitable security bug makes it sound perfectly natural to build your own memory manager when the one provided by the OS has "bad enough" performance.
Great, and how do the users keep track of which of the hundreds of sites they use have done that? With the idea I'm proposing, it's possible to automate this _in the client_, such that users can proactively defend themselves against sites that haven't patched themselves or even indicated whether they were ever vulnerable in the first place.

"Do you want to visit this web site? It may by vulnerable to the CVE-2014-0160 (a.k.a. 'the Heartbleed bug')." or the like.
> Engage in the same type of political actions.

Donating to a candidate that isn't a single-issue candidate, even one opposed to same-sex marriage, is not the "same type of political action", relative to same-sex marriage or gay rights more generally, as donating to a campaign that is solely about enshrining prohibition of same-sex marriage into a state constitution.

It might be a similar act if it is motivated by the candidates anti-gay or anti-same-sex-marriage views, but in and of itself it isn't the same type of action.
This looks great and I would love to use it for both SICP and learning how to draw. I don't mind paying for online services like these. However, I don't have an iPad, but I do have an iphone and an MBA. Where does that leave me and all the other potential customers like me?
Selling Bitcoin Froth
I'd rather have an universal api to change my password on every service, this way I could just batch-change all my passwords from something like Keepass in a matter of seconds, instead of having to waste some hours to change everything, while figuring a different ux on every site (and while we're at it, a standard that define what can go and what can't go in a password. Every site has different rules, and sometimes those aren't even listened. The worst I've seen was a site that allowed me to change my password, but refused the new password when trying to login).

I realize that this won't happen, but hey, since we're already dreaming about something that should get implemented by every site...

Anyway, as someone already said, in an hypothetical world this should be useless, as if a site is vulnerable it should get fixed ASAP, and force a password change to every user. And in the real world, almost nobody would check the hearthbleed.txt file (yes, software like lastpass and keepass could check for the user, but a very small % of the internet use such software).
That requires keeping a huge amount of state and doing a lot more complicated programming then just checking a few fields in a YAML file.
The numbers being discussed are the physician fees, not the facilities or supplies charges. This is the cash going directly to the docs to compensate them for their time.
Book Marketing: How to Use Hashtags to Improve Your Twitter Reach
this behavior is more common than not

This has not been my experience. I've contributed to many different projects, large and small (chpasswd, sendmail, apache, git, gerrit, openconnect, homebrew, msmtp, textmate, ...) and never had trouble getting a patch accepted.

edit: downvotes, really?
Local Police ask Bright House Networks employees to Report Suspicious Activity
The path to fixing it is in part through marketing. A lot of companies need to be aware about how dangerous this vulnerability is. Look how hard is it to get them to upgrade to latest TLS or most modern/secure ciphersuits, and so on. If marketing can help convince them to do it a lot sooner, than god speed.
It's easier to focus and learn on dead trees. For the author it's an interesting model too. Posting online, especially "beta" versions, gets you fast feedback and ultimately a better book. The paper sales are essentially a tip mechanism.

I am not allowed to sell "Mature Optimization" because it's owned by my former employer, but I had some nice bound copies made as gifts for people who come to talks.
If it works @local why not @ Fed...the concept at least
What Bitcoin Users Need To Know About Heartbleed
I'm sure many people did, but I don't know how reasonable that was, or how much Mozilla, as a company, will promote an anti-gay agenda because its CEO supports these views (if he does, I don't know him and haven't been following this story closely).
It's obviously going to be a lot easier to convince maintainers of web sites with wildly varying stacks to drop a plain-text file into the root directory of their site, then it is going to be to convince them to implement a universal password change API.

If Mozilla, Microsoft, and Google added support for /heartbleed.txt to their browsers then a whole lot of people would check it. Even if not, if password managers are modified to check it, and this leads to even a minor increase in the penetration of the user of password managers by users of the internet, that would be a good thing.
> That's an enormous win.

Compared to what? Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has.

A problem we used to have, however, is people engaging in grandstanding and irresponsible disclosure, leaving users insecure and catching the industry flat-footed.

Empty scare marketing is a solution to a problem we don't have. It's also a great tool for self-advertisement, and I can only assume that's why patio11 jumped on it.