skysight-inc/HackerNews huggingface dataset:
It's definitely totally fine to build these things for fun, but with a landing page like this, it seems like the author built it for some purpose beyond that, otherwise I don't see the point in presenting it in this form.

If the author wanted to learn _and_ get publicity, a blog post or at least including a "why" section that says "just for fun" on the landing page would seem suitable to me.

There probably is some interesting motivation for doing this, it's just not clear what it is.
Moreover, unlike HTTPS/X.509 you don't have a problem where another CA can just issue a certificate in your name. That is, if you hold a private key for a cert for .example.com from VeriSign, Comodo can issue someone else a valid certificate for .example.com and your users would not know the difference.

With PGP/GPG there is no CA: you create a private/public key pair and initially nobody trusts it. But by exchanging and signing keys through the extremely laborious process of verifying identities you actually establish trust for your specific key, thus making this system much more robust.
The vulnerability is in OpenSSL only, and no major browser uses OpenSSL. Firefox and Chromium use NSS, IE uses a Microsoft library, and Safari uses Apple's SecureTransport.

Other OpenSSL-using clients are definitely vulnerable though - best bet to tell if you're vulnerable is to check the OpenSSL version.
I'm pretty sure if you're using herokuapp.com then you're not using your own cert and Heroku will update it for you. If you're using ssl:endpoint then you will have had to submit your own cert, and that will need replacing.
Don't worry, you're still storing secret information with a proprietary web service that you can't audit. You're safe!
And if I recall correctly Graal, the next generation Java JIT Oracle is working on is also working on Python support. By far not there yet but pretty cool to see them take their compiler efforts beyond Java.
64k, not 64.
One problem with the Judge's statement is that it is beyond the scope of an actual case or controversy. A Judge should judge each case individually not make up general rules and policies to prospectively apply to future behaviour, since that is for the legislature and executive in a separation of powers system. If the Judge wants to issue a warning or punishment to a particular prosecutor for a particular inappropriate behavior that would be in bounds; but media statements designed to influence elections are out of bounds for american judicial behavior.
Bonedryhumor`s remake of "Saving Private Ryan"
Time to go shopping for a good attorney with expertise in employment contracts & corporate law. You can find one by networking for referrals with other lawyers. Personally, I prefer sole practitioners, with previous Big Firm experience. Usually they offer personalized attention, backed with major-league seasoning, more reasonable fees. You'll want someone who listens, asks good questions. Here's a good overview> http://www.forbes.com/2008/10/08/hiring-legal-help-ent-law-c...
Yeah, up until very recently it would be possible to make a script that would log you into a random yahoo mail account. For vulnerable servers right now it would be better to just block port 443, forcing regular HTTP is safer.
I get the feeling that YC (and similar incubators) are less about making a profit and more about connecting successful entrepreneurs with up-and-coming entrepreneurs. This isn't bad; it gives the YC partners (most of whom never need to work another day in their lives) a way to give back to their community, and I suspect many of them enjoy it.

It can't be based on pure charity because that's not a sustainable model, so there's got to be an equity component. But I suspect YC barely breaks even.

Regardless, the way VC measures returns is typically at between 70% and 100% of the life of the fund. If after 7 years, you're getting 1x your money back, that's a pretty big loss considering you could have just put it in an S&P index fund and earned ~7%. Even a 2x return after 10 years isn't that great; you're looking at an equivalent annual interest rate of ~7%. Things don't even get interesting till you start talking 5x or more (~17%). The time component of the equation is very important; the only reason people invest in VC is because it has the potential to provide greater returns than other asset classes if you're patient enough to wait 10 years for the payoff.
Indeed, that's my expectation with herokuapp.com.

However, this blogpost says, "As of Tuesday, April 8 at 15:55 UTC, all Heroku certificates and infrastructure have been updated and are no longer vulnerable"... while the certificate still superficially looks like it's almost 3 months old. Something isn't as it seems, I hope it's just the certificate age.
I'm aware how you download packages but I don't know how Ubuntu actually gets the packages it will be distributing.

How do we know Ubuntu isn't distributing a trojan'ed version of keepass?, is what I'm saying. If keepass doesn't have a secure mechanism for distribution then how can you be sure Ubuntu got the correct copy?
Go-ahead to ship office for ipad
Connections with Integrity
it's scary for a number of reasons, you outlined the biggest ones. You are basically saying you will be the COO if you do a good job, but then when exactly does their title change? What if you attract someone that is on another level in terms of qualifications and relative experience? If they don't become the COO in a given time frame as your company grows, there will likely be problems stemming at the core of your operations, which scares me. I would always let someone know there is room for upward mobility but this might be a little specific.
The potential risks depend on the data, don't they?
This reminds me of the time when i downloaded the Lastpass iPhone app, synced it with my Macbook's Lastpass, opened the Lastpass iPhone app _for the first time_ and it uploaded all my data to icloud without asking for permission... #fail

It was about a year ago, and at the time the iphone app apparently defaulted to 'sync -> iCloud -> on'.
The guy the article quotes is quite a character.

From his post:

"Sure NASA could go and investigate it, but hey, they are not on Mars to discovery life, but there to stall its discovery."

On a related note, I recently discovered that YouTube is a hotbed of dedicated quackery.

The amount of effort put into some of the "updates" and the odd intersections of religion, pseudoscience and misinterpretations of actual science are fascinating.

One of my favorite podcasts "The Skeptics Guide to the Universe" [0] does a good job of keeping abreast of and debunking some of the popular trends in wackiness.

0: https://www.theskepticsguide.org/
OK fair, 64K. But is it actually possible to control were you get the 64K from or is it just off the top of the stack?

And is it actually possible that the top of the stack has your private key?
Testing my externally-accessible OpenVPN server revealed that it is indeed vulnerable. I just powered the box off, going to be a long day at work before I can get home and fix it :/
There was a submission of this two months ago as well that only got two upvotes... Do you think the community changed that much in two months?

Maybe HN should take articles that get more than one up vote but die down to resurface in new several times to see if it slipped though the cracks or if it really has no value to the community.
I am very concerned about the .onion and .namecoin suggestions I have seen recently. The primary advantage of the internet is that it is universally accessible, but now people are promoting fragmentation in favor of security.
The Invention of the Slurpee
The HBO Go crashes could be the best thing to happen to HBO
Wouldn't Google Now at some point do all of this ? I think I guess Shifu makes it a little more mutually controlled.
It would be good if this learns over time on what to remind and what not. A pebble app integration would be nice.
What's potentially scarier than plaintext passwords leaking out is that key material leaks as well.

64k of random memory is bad, 64k of OpenSSL's state is worse.

Also, why haven't Yahoo taken down their login service yet? I really don't see how leaving your users' passwords leaking in plaintext is ever better than downtime. Someone had to have made that call, and I really don't think it was the right one. Will be interesting to see how the media treats this over the next few days.

EDIT: Looks like Yahoo is finally fixed. Wonder how many accounts were compromised in the interim, and if their cert and private key were compromised as well. Does not look like they've re-issued yet.
what is counter intuitive about the defense industry is that the development of new weapons like this (and the other weapons you have mentioned) have actually increased peace in the world. Certainly not the ONLY reason to be fair.

A great book on this is "The Better Angles of Our Nature: Why Violence has Declined" by Stephen Pinker. I recommend any pacifist (really anyone) read this book.

While we hear about the immense destructive power of new weapons, the reality is that they are seldom used. Most of our Defense budget is building an army that no one would dare attack. It is like our nuclear bomb policy -- 100% guaranteed retaliatory strike(s) but no first strike. This project is designed to replace expensive missiles with (relatively) inexpensive inert metal slugs that yield the same capabilities (range, stopping power, etc). This is most definitely a program that would lower costs and increase discretionary funding outside of the military.
I've been using Elasticsearch as a primary database for my new project, which has basically been a good NoSQL db that happens to have great search. However, peripheral tools(performance testing, hosting) have been a bit rough.

How do the two databases compare now. Is search improving in Mongo or is that something they are not really worrying about at the moment.
seems to be patched now
At least this article is better than CBS 60 Minutes lately. Their version would be something like, "Jeff Bezos pioneers a way to translate your brain waves into drone deliveries, and there's no need to worry about the NSA viewing your order history." Sponsored by ads for gerontology medications.
The best VCs have basically created a self-fulfilling prophecy: many of these firms do well BECAUSE the top VC firms invested in them. If a16z or KPCB invests in you, it makes it a lot easier to get press and additional rounds of funding from other VCs because one of the top firms "blessed" you.
Show hn: Online video marketing – everything about it
Tried again. Still get the same result.
Microservices – Not A Free Lunch
Despite people mention the lack of the data it's not a problem anymore. It was a problem like few years ago but these days we have access to thousands hours of speaker data. For example we have 100 hours of single speaker database at CMUSphinx, it's not a big problem.

Algorithms become a bigger problem these days. For TTS for example one has to implement hybrid speech synthesis technology combining hidden markov models and unit selection. Most commercial companies are using this technology, but no open source project has it released. The closest ones are OpenMary and Festival, but they are either unit selection or hmm, no hybrid synthesis implementation yet.
I would agree. My best guess is that they have a partial injury, so the stimulation allows the action potential to travel past the damaged part of the nerve. The article didn't really say though. They did say he had no movement past the waist, which is more of an indication of a full injury, so I'm not really sure.
Scary indeed. Has anyone created a status-board kind of site to show which major servers were affected and which are still affected?

I'd like to start changing passwords, but it doesn't do much good until things are fixed.
Far transfer to language and math of a short software-based gaming intervention
I don't know Smalltalk well enough to say for sure, it's just my rather vague impression that Smalltalk is more compiler-friendly, likely based mostly on what I've read over the years about this, for example looking at:

http://lambda-the-ultimate.org/node/2606

Ruby permits adding methods to individual objects; in Smalltalk, all methods reside in classes.

In Ruby, it is practical and somewhat useful to add methods dynamically; in Smalltalk, the practice is generally to treat the methods and classes as static.

Have also a look at:

http://www.hokstad.com/the-problem-with-compiling-ruby

I don't think all those 5 problems apply equally well to Smalltalk, do they?
To-do Automation. I love the ability of this app to automate creation of my tasks from phone callbacks, simple reminders etc. Great jobs guys.
my nexus4 feels neither large or chunky however the iphone5 feels like im holding a phone for someone who works at the chocolate factory.
AFAIK this refers to ZipPy:

https://bitbucket.org/ssllab/zippy
you get it right Shifu learn over time from your usage pattern . Pebble Integration in coming soon :)
I seem to remember a discussions about this a decade ago, with smalltalkers saying that the only big difference is that programmatic generation of code is not so common in ST as it is in ruby (i.e. "attr_*" is possible in ST but doesn't actually exist).

Other than that I _think_ maybe ST has a fixed number of slots per class compared to dynamically added instance/class variables in ruby? My memory is fuzzy.

By the way, there _is_ a ruby built by smalltalk developers[0] exactly because the object model is 99% the same.

[0] http://maglev.github.io
True - I am not saying with certainty that this is the reason, just wanted to start a discussion :)
There actually was a 'millionaire lunch' at a restaurant in Houston that was along those lines. Served with a glass of Silver Oak, as I recall.
I agree 100%.

I believe that line does more harm than any potential good.

IMO it would create this false sense of urgency and only sets up that person for failure. Within every company you should always feel the implication that if you do well enough, you could be the boss.

The person you hire will have this constant reminder of "why am I not COO yet". Which I assume would only create more tension.

If your goal with this line is to be more attractive to candidates who are maybe over-qualifed, or serious go-getters, I think you can show that more appropriately by upping salary and setting the bar higher for job experience/requirements.
The window in which the vulnerability was publicly known.

I'm trying to come up with a personal security model that doesn't end with me living in a cabin in the woods.
NSA Spied On Human Rights Groups, Says Snowden
While you're right, they definitely talked about doing simple stimulation via a control in the article (They mention they had people lined up to do that in the article - I do recognize that's different then the headline.)

I'm guessing this patient has more of a partial spinal cord injury (So the spinal cord itself was still intact). Stimulation may have then allowed weaker signals to make it all the way though. This is definitely a big deal, but it won't work for every patient. One of the biggest challenges in the area of brain-controlled movement is that brains are so unique to everybody, and stimulating the spinal-cord directly is hard to do without accidentally stimulating other parts of the body (In general, stimulators are past the spinal cord and closer to the appendage they're going to move. Implants for the hand are usually located in the shoulder, and stimulate the nerve going off of the spinal-cord for example). If someone has a completely severed spinal cord, this technique won't make a bridge for the signal so it's not going to be a fix-all type of thing (Though, I'd be happy to be wrong!).
> I have only my own experience to go by, but it takes some effort to call forth images and it definitely interrupts my ability to think through something.

"It (Visual Thinking) is common in approximately 60%–65% of the general population." - http://en.wikipedia.org/wiki/Visual_thinking

http://en.wikipedia.org/wiki/Autism_spectrum

An amazing lady: Temple Grandin. (https://www.youtube.com/watch?v=fn_9f5x0f1Q) (http://www.grandin.com/inc/visual.thinking.html)

I happen to lean towards visual thinking. I can see and run systems in my head. When I see a mathematical equation I understand, such as f=ma, I feel momentum and see acceleration of shapes in my head. If I can't form that mental picture, I can't do the math. It sucks because even though I can do all of that in my head, I can't remember your name. This is just me. People don't think the same way.

Now, let's considering the situation where source code is the only way to program a computer. This leads to a self-fulfilling prophecy where a majority of the programmers are a certain types of thinker. Sure, people can think using different approaches (as you pointed out: "but it takes some effort to call forth images and it definitely interrupts my ability to think through something"), but it isn't easy for them. It takes extra effort.

> paradigm is separable from notation

I guess I may be conflating them because I see paradigm as driving notation and/or notation can drive paradigms. But perhaps this is a result of how I understand things.
> But, they don't exactly need 100,000 to be a solid threat either.

At least as of October 1967, 1/25000 of that figure would have sufficed.
In some respects I don't know, as part of this tech is new (The part which allows voluntary movement). I have a feeling the patient only had a partial spinal cord injury (Though, usually with partials there is some movement retained). In a partial, the nerves themselves aren't severed, so it would then seem like the stimulation allowed the normal nerve impulses to travel over the part which was damaged and make it down to the nerve.

Either way, 'stimulating' a nerve means applying an electric current to it to simulate a brain-signal. It's not as complicated as it sounds, it's not much more then sticking an electrode around the nerve and then applying an AC or DC current (Though AC and DC do actually produce slightly different effects). I've had it done to my hand before (Via some simple surface electrodes), depending on the placement and nerves which receive the current different muscles start pulling. If you stimulate the correct nerves, you can have the correct muscles pull and create Ex. a fist, or a clenching motion. Implants right now don't do a ton more then a simple 'open-close' type motion for a hand (Since the intent is not so you can type on a computer, but so you can eat by yourself or pick-up a glass, etc.)
Programmers add abstractions just as fast as Moore's Law adds speed.
if you are looking for a nosql dbms as a service which consumes json and supports SQL and search, you could try amisaserver
Tweet pinning seems kinda weird. Do people really want to feature a single tweet on their profile? Are they going to remember to change it or will pinned tweets just end up being old and useless?

I also liked how simple the current profiles look. This new design seems crowded to me.
AWS's ELB (which we use) were vulnerable, we'll be replacing certificates ASAP. We (and most the rest of the internet using ELB) seem to be in the clear now:

./heartbleeder zapier.com
SECURE - zapier.com:443 has the heartbeat extension enabled, but timed out after a malformed heartbeat (this likely means that it is not vulnerable)

When did you run your check? Do you have a recent binary of heartbleeder?
It appears that .zip is the standard for binary OBJ. That way associated textures and materials can easily be included in the zip.

http://clara.io will happily import and export obj inside of zip, along with a lot of other formats.
I believe you misrepresented that algorithm. While it is true that Shamir's Secret Sharing is unbreakable if you split the actual clear text among participants, it is not used that way. The actual use is to use SSS to encrypt and distribute the key used to encrypt the clear text.
> There was a submission of this two months ago as well that only got two upvotes... Do you think the community changed that much in two months?

There's probably pretty big effects from time of day and other things on whether or not things get upvotes. That's not a "hive mind", that's just the fact that upvotes come from people coming here as they feel like doing so, not from a bunch of 24/7 staff that are paid to apply objective, consistent criteria (which would be a kind of hive mind.)
Give grep's -C option a try!
I've got a few I might like to pin. For example, if I've recently written a new blog post or found some new thing, I'd want it to stay on top for a while.
Here's my uneducated guess: the Python maintainers see NumPy as a bit of a killer app, and the NumPy maintainers would like to be a MATLAB killer. The entire MATLAB language is designed to make life easier when dealing with matrices (people think it stands for MATh LAB but it actually stands for MATrix LAB.)

MATLAB went down the matrix rabbit hole so far, they made ordinary scalars second-class types. If you want to multiply scalars or otherwise do element-wise operations, you have to prefix the '*' operator with a '.'. If Python can make their language more linear-algebra friendly while avoiding that sort of silliness, I'm all for it.
Powerbar Energy Gels and Shots
Silicon Valley is Iterative
All Oxford University Press Online Products Free April 13-19th
For cases like this, a trusted, external system would post data into the contract.
It has been repedately demonstrated that it is possible to get private key from the server using this vulnerability, as well as user login details. You don't have only one shot - you can query the server multiple times (and every time you will receive slightly different data) until you have everything you want. So yeah, the issue was/is very serious.
I hope you get more than $50,000 a year + 0.25% equity if you are the COO.
Apologies, my mistake. I'd redact my comment if I was able to.
As i understood, the main issue here is cost .. providing satellite links to each and every plane flying out there and to datacenters will be expensive.
“-webkit-animation: cubemove” in Chrome 29 can overheat your CPU
And you can sort talks by t-shirt color.
John Sculley starts a new phone company in India
Aminator + Asgaard + Simian Army (along with other open source offerings from Netflix) can get you a lot of the Lunch for Free.

That said, you need to know how to use them and invest significant time and effort in getting it up and running.

http://netflix.github.io/#repo
Peek took a sneak peak into our startup
You find this is an argument you can't easliy dismiss? David Einhorn is personally worth $1.25 billion and Bill Ackman is worth a similar amount and you think that they're going to pack it in over an HFT making it slightly more difficult to place an order? The rise of HFT hasn't stopped Bill Ackman from making huge bets on companies like Herbalife and JC Penny. I won't even get into the fact that he probably paid less to execute that large order than he would have in the previous pit trader environment.
> Examples: 4cm by 2cm, red PCB: $12 for 10 copies - This should go on the front page.

Funny. It would be a thing that would discourage me from using your site. Lack of graphic and flashy ads actually is very pleasant to the eye.
Dollars to donuts the NSA has had this hack in its bag of tricks.
The package is called libssl1.0.0 -- it holds the shared libraries, while the openssl package contains utilities.
In case the bug was really actively exploited on Heroku, updating private keys and changing Heroku password can be not enough. SSL endpoints forward all HTTPS traffic, so according to my understanding cookies, application specific passwords, basic auth credentials could have been potentially compromised.

Another potential vector are add-ons that use encrypted connections (for example Heroku Postgres). These also could have been targeted, in which case add-ons credentials would need to be regenerated.