skysight-inc/HackerNews huggingface dataset:
And no SQL keywords allowed in passwords. Because they like to advertise that they don't bother escaping user input before concatenating sql strings to store plain text passwords in the database.

http://stackoverflow.com/questions/13738141/blacklist-filter...
Sorry about that. I thought the "maybe" was sarcastic.

Anyway, the parent's point seems to be that individualism is a strategy that is optimal for a single person, but suboptimal for society. The reason is that what activity maximizes your financial return does not generally maximize the return for society as a whole. Individualism is therefore not optimal. A specific example would be a world that had no crime and therefore no need for security, law enforcement etc. Obviously a lot more efficient than a world with crime. However, since stealing would be free of consequence, individualism dictates that you should steal in this hypothetical world. Everything may not be a prisoner's dilemma, but most is. I don't see how that's nitpicking.
Do you have evidence of that being true a week ago? It's no surprise that the CIA and FBI would scramble to lock down vulnerabilities as soon as they were announced, but that's not proof that they never had them in the first place.

After the Snowden business, I wouldn't be hugely surprised if the gov't was secretly aware of Heartbleed, but I'm not comfortable taking a random stranger's word for it.
While by no means as well-formatted,
the following list contains the output of
my now-redacted script:
http://pastebin.com/NT2TKRTM
What was the original title? I really don't get it.
Naive set theory by Paul Halmos
Like many routes in the US/Canada the NYC<->Montreal one is shared with freight, and for a significant distance on it there's only one track. Since the freight lines own the track they take priority, so the passenger trains have to go slowly, and often give way.

That route, picturesque though it is, is also not remotely economically viable. The parts of New York state it connects to are very poor compared to the endpoints, and it just doesn't get enough passengers. New York subsidise it to provide those communities with some links. (A drive through more remote parts of NY can be really depressing, but the Adirondacks are amazing).

The simple reality is an improved normal speed train service wouldn't make a difference, but the cost to build high speed is ridiculous either because the distances are too large or you're in already built up areas.
Do these several book stores in your town send books overseas? Are their prices (including packaging and shipping cost) reasonable? Do they provide a site where i can find reviews about books i am interested in while ordering?
Civilization: Beyond Earth announced. Civ is going to space
On what grounds? If it was GPL'd code and GS was conforming to the GPL terms, what are they to be sued for?
Just a thought: I supposed many of them are in fact very smart people. Hours of practice certainly helps a lot as you can break down a complex problem into smaller and familiar problem sets. Some people like Nick Wu probably isn't your average student. Also luck plays a major part. If you just happen to know how to solve problem X you can solve it quickly.
In addition to the studies and guides as linked above, the best service tip I can give is to be predictive of the customer's needs.

Listening and reading their body language and providing them refills, extra sauces or napkins, suggestions on obscure wine, recommendations on local activities, the most recent sports scores, or a free item -- before they have to ask for it.

In the case of regular customers this means being stocked with their favorite item or getting their order or preferred table ready as soon as they walk in the door. People's time is valuable and if you can save them time and effort, and make them look good (lots of business deals are done over food or drink), it can be worth 50%-100% or more in tip percentage. There is far more to provide than just food service, good tippers go for the experience. If you know how to provide this experience, the few low tippers are no problem at all.
I am curious why/how you concluded this was a libertarian analysis? Do you and tptacek have a history that gave you additional context to what he wrote? When I read it I did not see anything that screamed libertarian.
Really cool, another quality resource to help kill W3Schools.
"Microsoft's forgotten subdomain" or words to that effect.
I feel like there's a business opportunity here. There is a large group of people who don't want to think about tipping, and would always just tip 20%.

Could a payment system or card do this automatically? Or perhaps legally signal to the server that they should take 20%?

This doesn't seem impossible, and I think the idea has a reasonable market.
Yes, MSVC does this when the /hotpatch command line option is provided.
The odd thing is, though, I still don't really see how you can solve C-small without solving C-large at the same time (other than actual brute-force). Guess I'll be keeping my eyes peeled for the write-up.
Since 2008 researchers at Belle in Japan found hints of a four-quark particle. Those hints were confirmed.

"This reinforces the 5.1σ (4.7σ) rejection of the 2+ (2− ) hypotheses previously reported by the Belle collaboration, and confirms the 3.4σ (3.7σ) indications from Belle that 1+ is favored over 0− (1− )."

Belle collaboration, K. Chilikin et al., Experimental constraints on the spin and parity of the Z(4430)+ , Phys. Rev. D88 (2013) 074026, arXiv:1306.4894.

"The cost [...] has been evaluated, taking into account realistic labor prices in different countries. The total cost is X (with a western equivalent value of Y)" [where Y>X] source: LHCb calorimeters : Technical Design Report ISBN: 9290831693 http://cdsweb.cern.ch/record/494264

or: "1the western equivalent value is 1'390 kCHF. 2the western equivalent value is 5'450 kCHF" http://lhcb.ecm.ub.es/spd/spd/General%20information/spd_cost...
Precisely my interes what is the SICP equivalent for: Discrte Math ? And for Linear Algebra?
Akamai patch for Secure storage of private (RSA) keys
I'd bet that patterns like

$db->execute("INSERT INTO USERACCOUNTS ('username','password') VALUES ('".$_POST['username']."','".$_POST['password']."')");

are more common than anyone wants to believe.
I disagree. Unlike other years, there is no "hard" problem in this round. So far, 2581 users have submitted an answer to C-large (the "hardest" this year). Last year only 547 users submitted an answer to D-large (and only 141 got the correct answer).
Mandatory Reservoir Dogs clip: https://www.youtube.com/watch?v=V4sbYy0WdGQ
My criticism of the headline is the same as your experience: just because you're not taking tips doesn't mean that the restaurant management is on top of their game. Running a restaurant is hard, and there's a thousand ways to screw it up.

Here's my anecdote: I ate in a tipping restaurant in Texas. The steak was late, lukewarm, and so small it slid across the empty plate. The only thing accompanying the steak was a pot of mashed potatoes about four times the size of a thimble. After being largely ignored, the waitress at the end of the meal made a ton of excuses while looking at the wall so as to get me to still tip, and zero effort was made to make me feel better about the situation. If we're making sweeping proclamations from single experiences, then this must mean that tipping restaurants make for very much worse experiences.

I don't like tipping culture for all the usual reasons, plus a couple more. I don't like the waitstaff's arms being constantly in my dinner conversation, as they refill water or keep checking how I'm doing. I don't like that in almost every other job you can have a crappy day but still come out of it with the same wage - tipping faults people for being human. Imagine if software devs had a variable rate largely based on how they were feeling that day? I mean, code and design when you're distracted or angry isn't as good as when you're focused and content, so it stands up to the same reasoning. HN would be in furore if a tech company proposed that.
I'm not a libertarian. Rather the opposite (a mainstream down-the-line progressive liberal).
Ask HN: Does famo.us actually run at 60fps?
Does famo.us actually run at 60fps on mobile devices? Or more generally, how can we actually measure fps for famo.us animations?
That hasn't been my experience at all--I see tons of restaurants filled with plenty of people in most European cities, and they seem to have adequate numbers of efficient waitstaff.
Coverity also has a free trial you can do online with your own code: http://softwareintegrity.coverity.com/free-trial-coverity.ht...
"I don't know if they are geniuses or if they practice this stuff every day."

It's not an either/or question though =) By most common definitions, the guys at the top, specially those that reach the finals are "geniuses" at algorithmic problem solving, yes.
The small discussion happening on reddit is convinced upverter is using this as a lead generator.

http://www.reddit.com/22sflo
One of the large design-constraints of Erlang is being able to hotpatch, given the uptime requirements for telephone switching.
I changed the title because it violated the HN guidelines about titles: it editorialized, it was linkbait (Microsoft's forgotten subdomain!), and it was misleading (how do we know what Microsoft forgot? how do we know there aren't many of them?).

HN calls for people to make up their own minds about content. It's not for the submitter to spin "the point" for everybody. Other websites allow that; HN does not. In my view, that is one of the best decisions PG ever put into the design of this site. It's controversial only because people don't notice all the good it does, which is enormous: it's one of the biggest factors in the quality of the front page.

the whole point of this post has now been lost

I disagree. It doesn't take much to see that this is a legacy Microsoft website that is still up. HN's title policy does lead to hard calls sometimes, but this wasn't really one of them.
Vacillating between floating away on my recently-inflated feeling of
self-worth and trying to keep you engaged on a very uneven playing field
(as in my not knowing Adam from Eve, so to speak), I'll simply opt for
another Thank you.
Don't complain about being downvoted. It is in the guidelines.
I think the real problem is that Americans identify cars with freedom and rail with "socialism" or something. Throughout much of the U.S. there is a profound anti-public-transit sentiment. It's viewed as a waste of money, a boondoggle, etc.
Very few people will actually have lost privkeys. Patching your server is a much more important countermeasure than revocation. Certificate revocation in practice works nowhere nearly as well as it does on paper; in fact, it comes dangerously close to not working at all. Read Adam Langley's (jaundiced) take on OCSP for more details.

Long story short: certificate revocation is probably not a big enough deal for Start to somehow be required to rewrite the terms you agreed to when you acquired your certs from them.
It's worth noting that this ~$40B is just for broadcast TV ads. This excludes cable TV ads (~$30B) and subscription TV fees (~$80B). There is an ongoing non-zero sum shift in attention and dollars to online, but TV is far from dead.
Restoring Confidence in the Digital Economy
Change the license, exclude apple, and send them a CnD if they use the library going forward.

It's probably faster and more reliable to do this than file a radar.
I'd like to give a big sloppy wet kiss (or just a high five) to ScottyE for linking this. I always felt like I walked in halfway through the CSS story and like I just needed to play catchup through trial and error because try as I have, I've failed to find a resource as clear as this. In short, as a designer who never really learned CSS properly before today, this is a godsend. Thanks.
Chez Panisse in Berkeley has been running with a 15% service charge since 1989, and you still have to call a month in advance to get a reservation.
"other than actual brute-force"
Apropos nothing else: tlslite and Adam Langley's golang/crypto/tls are the two best codebases on the Internet to (a) learn TLS from and (b) build tools with. They are both extremely great projects.
What kind of reasoning is this? How is performing in a programming competition like Code Jam an indication of whether you are a good developer or not? Unless of course if you just want to hate on outsourcing, in which case, go ahead and do it but please don't try to make it sound like you are basing yourself on logic.
Annoying, isn't? I presume it falls victim to the over-strict interpretation of this rule:

> Otherwise please use the original title, unless it is misleading or linkbait.

I had a similar problem with this submission:

https://news.ycombinator.com/item?id=7561847

Which I think I originally titled something along the lines of "Proof of Concept code shows clients are vulnerable to HeartBleed"

or something like that - since the discussion actually showed a link to some PoC code. It was renamed back to the anodyne "What clients are proven to be vulnerable to Heartbleed?"
My solution for 4 was quite efficient in design (and very simple). I was able to be very inefficient in the rough implementation (being lazy and copying arrays, reading the entire input file at once and breaking it up into lines in memory) and still, using JS, solve the large set in only a few milliseconds.

That should probably be a few orders of magnitude higher to realistically make the time constraint remotely difficult.

This was a fun problem to think about, though. Naomi is such a cheater.
They're in both browser's truststores. That's about as "trusted" a CA can be by an inanimate object.

For a CA that issues hundreds of thousands of certs, three instances of mistakes is not damning. Whereas a CA, like STartCom, that boldly proclaim to be the second coming of CA-Jesus and gives away certs for free and relies on predatory charges (pay high fees when you're in trouble) is.
You're missing Thalmic Labs in Waterloo! They are the makers of the Myo! ( https://www.thalmic.com/en/myo/ )
You make john young sound so tacky when you say "he bills himself as..." I remember downloading things from him over my modem. He has archived tons of things over the years.
Yup, the threat horizon for Heartbleed only starts at March 14, 2012 with the first release of OpenSSL 1.0.1.

http://openssl.6102.n7.nabble.com/OpenSSL-1-0-1-released-td3...
The context is different though - the professor is stating that an anecdote is a data point, and plural data points can be referred to as data. Two stories are two datums, pluralised to data.

The "not data" version is saying that anecdotes are in such small numbers and uncontrolled circumstances, that even though they are data points in and of themselves, they're not rigorous enough to draw wider conclusions from. It's a different context.
((R.i.n.g))Bradley.vs.Pacquiao.Live.S.t.r.e.a.m
((R.i.n.g))Bradley.vs.Pacquiao.Live.S.t.r.e.a.m
Auto adblock at the ISP level

Just a small fee to disable it for your ad..
To paraphrase Thomas, a core issue is getting the right eyes auditing code. We need more CTFs that offer cred and prizes to keep projects honest. Also, important core projects like OpenSSH, OpenSSL, GnuPG and core projects like zlib need to be held to a greater deal of scrutiny and adversarial reporting. But as it stands now, projects like zlib dont even bother GPG sign releases, so how much confidence can you have in the rest of their security posture? This is failure by way of academic happy-clappy laziness waiting to happen. Also other important projects like Glibc that were massive big balls of mud are likely to conceal all sorts of vulns by their enormous codebase and number of features AND poor support history, hence Debian's selection of eglibc.

So in conclusion there are a number of hard but necessary steps to reduce the threat surface from this sort of thing ever happening again. Because doing the same thing and expecting a different result is the literal definition of "stupid."

FOSS is part of the economy and important projects should be treated with the seriousness, responsibility and customer service of a business, even if the sale price is $0.
Instagram
Instagram, fora do ar! Porem pra mim nao! Partiu: hackear hauahauaha
>I get the Little Spies Orwell parallel, and it does give me pause. What I don't have an answer to yet is: how is this fundamentally different than the police having a tip hotline?

Both are bad. But actively encouraging people to record and snitch other people is worse.
My favourite blog post of 2014. Thank you for sharing.
RawGitHub CDN
Please don't give potentially useful hints until the end of competition
> StartSSL's default usage mode is to generate private keys on their website.

No. AFAIR they use HTML5 <keygen> tag to generate key pair.
Bad link - got another?

I think it's fine if they're doing it as a lead generator. If only more pro-social things would yield profit so that they would actually happen.

Or maybe, they did like we at CloudFab did, and opened up our hard-won supplier database of 3D printing shops after using it internally:

https://mapsengine.google.com/map/edit?mid=zkIlt1cSAfh4.kskl...
> I changed the title because it violated every HN guideline about titles:
> it editorialized

Only in the sense that the title was both the crucial to the content.

> it was misleading

I really don't understand why you think so.

> and it was linkbait.

Then the whole post should have deleted. Changing the title made it completely pointless.

> It doesn't take much to see that this is a legacy Microsoft website that is still up.

It really does. I was baffled until I read the comments.

> Please don't be rude to other users on Hacker News, even if they're a moderator.

I don't feel 'cut it out' could be deemed rude by any reasonable standard.
The PHP manual pages are full of user comments with helpful suggestions just like that, which incompetent programmers copy and paste into production systems. But I think of it as a good thing, an instance of evolution in action, because banks that hire such stupid programmers deserve to have all their money stolen from them.
I use www.librarything.com to manage books, find books, read/write reviews, search libraries, link to book stores, ...

Isn't Amazon is a tax avoider, union hostile and privacy hostile company?
> additional locations in OpenSSL are also flagged by this analysis, but it isn’t my place to share those here.

Why do I get the feeling that we're going to see three months of new OpenSSL vulnerabilities, like we saw with Rails last year? I'm sure Heartbleed plus all the bad press about code quality means a lot of people are suddenly looking. Assuming there is more to find, does anyone have any advice for how we might prepare for it?
Link is fixed, missed a 2 when I copied it over.

I'm not necessarily agreeing with the discussion, just food for thought.
I don't understand, what's the problem exactly? Is this against Mogenerator's license (it doesn't appear so)? The article described a hypothetical scenario in which an app using Mogenerator might get incorrectly rejected for using private methods, but there wasn't any evidence that this has or will happen, or if it did happen that it would be anything other than an easily corrected mistake. I must be missing something.
Installing HiveMind IDE on your Digital Ocean droplet
Everytime you visit a GA enabled site, it sends back some information to the Google servers including url, referrer, time spent etc. Google can use this build up a history of websites you (this is not linked to your Google account, more like an unique id) frequent and show targeted advertisements.
Now you just need agl and pbsd to come along and tlslite will hit the HN crypto-trifecta.
open source doesn't necessarily mean "anyone can edit it and improve it".

patches and added features need to be reviewed by project owners.

open source mostly mean "you can read the source and modify your version, but that doesn't mean you can make a change that will go into the official release."

There are some very sensitive implementations of software which should be thoroughly examined by experts and criticized if they're not good enough. If there is no resources available to maintain a particular open source software, don't bother use it, ESPECIALLY if it's sensitive like openssl.

Open source allows software companies and other programmers to easily work together to solve a problem. Developer's time is precious so it's often time-saving to use somebody's else work, but that doesn't mean you should use it blindly.
It does make a tangible difference in the cash economy though. When the price tag includes tax, the prices are generally set to easy multiples of the currency. Fewer coins to cart around and manage (and no give/take a penny trays). I found it amusing in the US when I went to McDonalds and ordered three things from the 'dollar menu'... and was charged $3.24. I also found it odd that a few Americans, despite living in this system their whole lives, had trouble in predicting their costs at the register.

Here in Australia there's a 10% sales tax, included in the original price. For anything above a few dollars, most prices are whole dollar amounts, and the vendor sets aside 1/11th of the price for the sales tax. What you actually pay is easy to manage and predict, though you get a receipt specifying the tax with odd numbers (due to the 11ths). Go into a supermarket and buy a carton of Foo for $2.69? It's $2.69 at the register.

My gut tells me that this is why Americans are so much more vocal about tax - sales tax is a stone in their shoe. It's addition at the register makes things unpredictable (not to mention any sale that crosses a border somewhere). Here it's streamlined away, and there's no cognitive weight borne by the consumer at all.
Thank you. I think people should try to explain their downvote whenever possible so that I can have a decent discussion as my argument isn't always "correct".

Like I said I don't know the cost to revoke certificate as a CA. One possible defense for StartCom is that they are worried about facing the same bill as the next critical vulnerability emerge. Someone said in some other threads that StartCom has this fee from ancient time. If that's true, this is just another "fine print" issue.

> but end users (those who see the false green padlock) have full moral right to call such CA "evil".

I agree. Though the question remains: should the CA take the blame of the flaw of a library every time given CA is not a charity, but a business?
> They were up-front with their clients

That assumes that all their clients were paying attention. That is almost certainly not the case. It is arguable where the responsibility lies in a case like this, but there is a case to be made that Start carries at least some of the responsibility for having created an environment where such a critical item was so easy to miss.

I am not saying that Start is in fact the villain it is being made out to be, only that the "you get what you pay for" argument should not be the last word.
comex's second comment pretty much sums up the whole situation. It's bizarre that anyone even has other ideas at this point.
This is just quals...
I didn't know whether he was a libertarian or not, but ignoring externalities is a hallmark of libertarian thought. I apologize if I made an unwarranted assumption. But the substance of my comment applies regardless.
Performance at Google Code Jam != Ability as a software developer, for sure. However, being unable to solve a couple of the simple qualification round problems in a language of your choice with no time pressure is a strong negative signal (for reasoning and/or coding skills that are essential to any software developer).
Please explain how they're not being nice here.