skysight-inc/HackerNews huggingface dataset:
What's the ballpark cost of the hardware that you used to get those 8 BTC?

(It's interesting information for observers, of course people are turning on hardware that will run profitably, but mild opportunities aren't going to drive a whole lot of purchases)

Edit: If you have the rough 'replacement costs' floating around in your head that's interesting too. So not your actual costs, the approximate cost of bringing equivalent power online right now.
True, the list was just referenced to show that everyone uses OpenSSL and that the large companies (practically every company in that list) should contribute to OpenSSL in some way.

It's pointless for Google, Yahoo et al, to enable inter-datacenter encryption if the front-end (TLS/SSL) is left wide open.
"wantrepreneur"
My Kindle Fire gets regular system updates. The latest was a few days ago. I don't know what the updates involve aside from updates like Goodreads integration, but I do know it's not getting worse. It was already nearly perfect the day I got it. The only update I'd want is Google Play, and that's not a deal breaker since I can sideload the important stuff.
I don't think that's very good reasoning.

Bad software is bad software regardless of who has funded it, who has committed code to it, or who has written its documentation.

One does not have to be a contributor to that software in order to analyze it and make a judgment regarding its quality.
.Net is dying. Even Microsoft has basically abandoned it for JS. If the goal is simply emloyment, front-end is easier to get started with...if you're serious you should start learning server/db stuff soon after you get your first job, because fullstack devs are the most employable.
http://highscalability.com/blog/2012/11/5/gone-fishin-buildi...
Since this is a bout Java and SQL in particular, I can only recommend our jOOQ blog, as we're heavily blogging about the two topics:

http://blog.jooq.org

Other good resources can be found in this top 100 list of Java blogs (not really containing 100 items, though):

http://www.programcreek.com/2012/11/top-100-java-developers-...

Oracle's Java tutorials are pretty cool, too:

http://docs.oracle.com/javase/tutorial/index.html

And this excellent SQL blog:

http://use-the-index-luke.com/
I have just finished porting my Android game Superior Tactics (https://play.google.com/store/apps/details?id=org.jrenner.su...) to iOS using RoboVM.

It's amazing to me that I can write my game completely in Java and get a performant AOT compiled version that runs on iOS.

RoboVM really is amazing for indie game devs, and it's open source. I've already donated around $300 to the project.

I've also done tests to see if other JVM languages work with RoboVM. So far, I have been able to get games written in Kotlin running. Can you imagine writing a game in a nice modern JVM language like Kotlin or Scala, and then being able to publish it to PC, Android , HTML5 and iOS? That's what is possible now, and all with open source.

Obviously, for those who develop non-game apps, native UI concerns mean you can't just publish the same thing to both Android and iOS, but for games that isn't an issue.
Just because of bad programming practices you are diminishing the language. If I'm allowed to make an analogy to what you said, it is the same as cutting a tree because we found a rotten fruit. I agree with the @CSDude arg, every language has its weaknesses and a good developer should recognize and understand that.
For the clearfix can't you just use `clear:right` or `clear:both`? Also for inline-block you can also use the ie7 hack `display: inline-block;*display: inline;zoom: 1;`. Nice tutorial though.
Can anyone compare this to Xamarin in terms of features/stability/workflow ? Xamarin is .NET/C# which is arguably nicer than Java but its also not too cheap if you just want to play around with stuff.
It sounds to me like the way to solve this problem is to turn OpenSSL into a benevolent for profit company with an actual business model.

Why not give the software away as is current practice but then charge top-dollar to MSFT, Google, et al. for professional consulting? This way they could actually devote real resources to the project and implement some of the obvious process reforms that OP and others are suggesting.

The OpenSSL mission could & would be executed better if it was pursued as a business rather than a hobby. Capitalism doesn't cure all ills, but it might be able to cure this one.

Thoughts? Am I missing something?
German magazine visits YouTube Space in LA (photos)
I don't think its insane at all. I don't think Seggelman backdoored OpenSSL, but he did come up with the idea, write the buggy implementation, and then submit it over a holiday when it was least likely to be carefully scrutinized -- abusing holidays is a hacker classic.

This has all the markings of a brilliantly executed backdoor. That being said, my inkling is it was an honest mistake.
DZone Research presents – the 2014 guide to continuous delivery
FYI ActionScript works fine.
The Benefits of Facing Our Weaknesses
Because good idea in theory != good idea in practice. Showing that this actually works in practice (albeit on an isolated incident) shows that the bug is dangerous in practice, not just theory. Look at all the research in timing attacks etc on TLS, some of which are theoretically feasible, until you consider real world possibilities of remote servers, such as "Their ISP is fiddling with routing so I have varying latency", or "They're using different server configurations and I don't get connected to the same one every time". This has been PROVEN to steal someones private key, which is worse than giving someone the keys to your house, It's like giving them a blank passport with your name on it, letting them put their photo on it, and with that taking your car keys and hosue keys, and everything that identifies you.

Luckily, the fix is easy, just upgrade, revoke, and force password changes for everyone.
CocoaPods is the dependency manager for Objective-C projects
I hate sites that restrict how complex my password can be. Seriously, NemID, a Danish ID every person has that's used for everything (banking, among other things), don't allow special characters. What the heck. It's like they want it to be insecure.
Dying? Not sure what your definition is of that, but no, it's not. .NET (and JVM) are great and very much alive. Plenty of opportunities on client and server for it. And for many years to come.
Not sure what's happening with Scala, it's been on a steady downward trend of late (from 31 to 48).

F#'s meteoric rise, on the other hand, when will it plateau, top 10, top 5?

Haskell dropped out of the top 50 which was also a surprise.

Ruby seems to have stabilized, looks like it won't be evicted from the top 20 anytime soon.

Other than that the 4 Cs continue to dominate.
I've made it a point to NOT check things in on Sundays. I break my own rule. I get the OCD gimmick to get yourself motivated but ...

I flies against of my philosophy of coding. Less is more, quality over lines of code. Not coding for coding sake. And coding on paper and writing out data structures and algorithms.

Hey, if a whole bunch connected green dots gives you a feeling of accomplishment. Enjoy!
Wow, I just tested this on Debian and you're right - the simplest thing really does work. Kind of makes me wish I'd tried a little harder at CloudFlare's challenge; I had something pointed at their server and doing this early on, but shut it down after a couple of hours because it was using lots of CPU and not getting very far.

Edit: My code's tested too - the primes it gives me are exactly the same as the values in the private key

Edit 2: Doesn't even have to be the first request after restarting, I fired off a few hundred simple test requests first and it still worked. It's likely that any lightly-loaded nginx install on Debian was wide open.
But if you continue to use that software then you probably need to be a little self-critical too.
Just checked, no encryption for me here
So I didn't manage to crack the challenge (I used around 10k heartbeats), but I suspect it may have just been a case of brute-force (i.e asking for enough heartbleeds). Other people may have got the key without realizing that had done so because they were looking for the wrong thing (i.e. normal cert text representation).

I took the approach of using two fingerprints to search the data:

1) The hex sequence "30 82 .. .. 02 01 00" which would indicate the ASN.1 private key encoding which OpenSSL uses.

2) The modulus which I extracted from the public key (which would also be in the private key structure)

I didn't find any instance of the first, the second I found lots of instances of (because the modulus is also in the public key). I then filtered out all the instances of the public key by searching for the public key header ("30 82 .. .. 30 82").

This actually left me with two unique instances of the modulus in memory which weren't in a public key structure. I then tried to overlay the private key structure over the data and extracted what should have been the prime numbers and ran a primality test on them (to verify; another way would have been to just feed the structure into openssl). Both failed, so it wasn't the private key structure.

But there's a reasonable chance that those two instances represented a cryptographic calculation in progress; so while recovering the key wouldn't be as trivial as if you grabbed the full private key structure from memory (which I suspect is what the successful attackers did) I think it definitely represents another attack angle.
Contact me via my contact info on my profile here. Plenty to do!

In the EU (I am there as well) there is definitely more than enough work in Java, C#, PHP, Ruby(Rails) and a lot more. The basic thing is; learn something well and you'll be able to pick up something else quickly. Java or C# are good starting points, but like said; there are other ways.

Edit: As croggle said as well; I wouldn't start with JS at all. I think that's a bad move.
You will be most employable as a full stack Linux Dev. Learn Linux, git, ruby/python/php/go and/or JavaScript. Make a couple personal projects, take a couple low paying contract gigs, and if you can actually ship code it won't be long till people are knocking on your door trying to hire you.

Becoming an expert in one of the more popular frameworks is probably the quickest paths to gainful employment.
learn Ruby and Rails, NodeJS, AngularJS or EmberJS, and you need some computer science knowledge like Data Structures and Algorithms to help you with interviews.

go to meetups, and work on your github
> native UI concerns mean you can just publish the same thing to both Android and iOS

That's a myth often seen in "deploy everywhere" mobile dev tools, in reality the design habits/guidelines between the two platforms have a lot of difference and you need a separate UI layer for each more often than not.

Doesn't change the awesomeness of RoboVM, but it had to be said.
On a related topic, a troubling new trend (to me) is the reliance on passwords being automatically generated/kept by a tool. You are putting your trust in something else for something only you (or a select group) should be trusted with. If everyone were to start doing this or a vulnerability was found in it and exposed, then attackers would exclusively target the tool or the password store, making many at risk.

It is a trade off, because you have the ability to use significantly more complex passwords that are harder to brute force or guess using personal information. Just don't forget that you are providing new attack vectors in the process. If they access your password store and you didn't know about it, how at risk would you be if they were to unlock all of your passwords?

Do you really understand how the password store and password generator work?
> Crypto is complicated and very hard to do well. Hell, any complex software is hard to do well. There will always, always be bugs.

There will always be bugs, sure, but differences in the engineering approach can result in orders-of-magnitude differences in the frequency of bugs.

For example, see "Some thoughts on security after ten years of qmail 1.0," where the qmail author explained why he thought qmail had a dramatically different security track record than sendmail: http://cr.yp.to/qmail/qmailsec-20071101.pdf

The kind of things he's talking about can't just happen on the level of "more people submitting patches" and "more financial contributions." You need a top-down approach that's designed to produce secure code.
Sorry, that was actually I a typo on my part, I meant to write "can't"
i suspect getting the key on cloudflare is much harder :) it will be interesting to find out how they did it.
Most people on here will push you towards the over-saturated market of JavaScript (insert framework of the week here). Personally, I would get to grips with something with a less hispter vibe that is oversaturated with devs taking low pay.

Learn Java, learn the Spring framework, learn Tomcat. These enterprise standard java based technologies will set you up for a solid and well paid career.
The price of popularity. With this increase in pro-Haskell talk in the echo chamber there will almost certainly be an increase in the number of people trying it out.
If you have any interests in road network routing (tons of interesting topological problems there) we might be able to help each other out. This is where about 90% of my time is spent.

As for interests, however...

Feel free to get in touch with me to talk EDA and EE stuff as well. I'm presently a bit fed up with EDA usability, and I'd love to discuss ideas for how to move low-cost EDA away from "mspaint" and toward REPL.

I'm also very interested in building a tight-loop GNSS/inertial navigation system from scratch using an RF front-end (MAX2769) and a 9DOF IMU on-a-chip. I believe all current DIY inertial nav projects like this use absolute position output from an off-the-shelf GPS. I think by including inertial information during the signal processing phase it's possible to get accurate and precise absolute and relative positioning.

Along those same lines, I think it'd be cool to try to build a single-station RTK GPS by measuring carrier phase across multiple GNSS systems/bands. I'm not 100% sure how to go about this however, but I have a feeling it involves a tunable multi-band receiver or multiple single-band receivers feeding into an FPGA.
Oryginalna Biżuteria Srebrna
Nasze produkty, to autorskie pomysły wykonywane w pojedynczych egzemplarzach lub w krótkich seriach. Podstawowym materiałem jest srebro łączone z kamieniami naturalnymi, perłami, czasem z innymi metalami. Mamy do zaoferowania oryginalne kolczyki, naszyjniki i bransoletki.
The fatality rate would be the same. We do not have any treatments available for any of the Ebola strains, as such our only option is to limit the spread. Whether developed nations are better able to do so, I'm not sure.
If you could present fashion in a way that appealed to me as a programmer, I'd buy it at any price.

Whenever I try to investigate this area, it seems like fashion and software engineering are both accelerating very fast in completely opposite directions. Inevitably I get dejected and give up.
Nations certainly have a record of killing large numbers of their citizens - particularly in the past century.

It's reasonably to be suspicious of government.
Upvoting because I think people misunderstand the nudge here: Dwarf fortress does both of these, and easily pulls in more money than OpenSSL by average. Sometimes up to twice as much if they just had a big release. (Which is - regardless how good dwarf fortress is - a shame).
"speaking out about them to gain popular support, and then making them law." -> that worked recently?
yeah. I made it follow a cosine path:

http://benvan.co.uk/cosine.gif
WARNING: AUTOPLAY VIDEO. Flagged.
Instead of knocking down someone for taking the time to share something of value, why don't you contribute as well? Sounds like a win-win to me.
How about they revoke your free certificate for free, but if you want another certificate for the same domain, you have to pay for it.
As somebody who would be classed as a "wantrepreneur", I really hate the term and its negative slant. For a community of people who celebrate the pathological need to "do it for yourself" we tend to look down on people who are learning how it is done. All the books in the world don't give you the character to succeed and the process of self-discovery and learning about yourself is hard. IMVHO, classification of our disorder on a scale of current success isn't productive. It seems to me to be a byproduct of the culture pushed by commentators who are making a living off being critical in the startup world rather than a term coming from those giving it a go.
Software Shows What Children Will Look Like In 70 Years With Accuracy
I take a look at TIOBE from time to time, but I wonder how relevant it is. Is JavaScript's popularity really about the same as Visual Basic.NET's? Is Python more popular than JavaScript? Is PL/I more popular than Bash?
p7b export of E0 D2 E0 key https://github.com/cradle/certs/blob/master/amazon.s3.p7b?ra...
What if someone hacked your server and stole, then deleted the private key? (Backing up private keys is bad practice.)

What if the CA notices they issued a fraudulent certificate?
It's Time For A native EventEmitter [2012]
Google, Eich, Rice: The Evil That Tech Does
Have you exhausted all possible scholarship options? Try a curveball approach at The Flaitron (I'm sure you may have already, though) and anywhere else where educational funding may be available.

I didn't think I'd be able to make it to a WWDC scholarship from the UK until I went past the usual funding bureaucracy at my university and went directly to the head of dpt who was kind enough to authorise a bursary for me.

I don't think money should ever hold people back people skilled and intelligent enough from the educational resources and creative outlets they can use to the full to prosper.

It's one of the tragedies of our time.

I wish you all the best!
Part of the reason people are annoyed it that this wasn't a complicated "crypto is hard" bug!

It was a stupid, "really? again?" type bug that is typical of low-level badly written C programs and a common cause of security vulnerabilities.
yes. two angles:
1) with a good teacher. where the teacher is using a system to teach.
2) language exchange. where both are at intermedite level or above.
i lived in Japan for 5 years. I use skype a lot to talk with people back in Japan.
Joe Armstrong – K things I know about building Resilient Reactive Systems
Ask HN: VPN or PaaS for a Node.js application?
I'm working on a startup project and we're trying to decide where to host our node.js web application. I like the ease of use of some PaaS, but it seems like they are a little more expensive as you scale. Which is better, PaaS or VPS? What provider should I use?
"Hardware donations do not come from vendors who use OpenSSH on parts of their stuff. They come from individuals. The hardware vendors who use OpenSSH on all of their products have given us a total of one laptop since we developed OpenSSH five years ago. And asking them for that laptop took a year. That was IBM." - http://www.theage.com.au/articles/2004/10/07/1097089476287.h...
I'm missing where there is anything saying that the main developer is missing (other than the title)...
An introduction to thinking declaratively and Boolean Satisfaction
Even if that was possible, you need a linker. Also recent versions of MSVC plug-in a pragma that contains the version number of the MSVCRT dll and once a .c/.cpp file was compiled with specific version it has this version in the .obj file, so if you try to link it with another version it'll complain. Recently they've added this for debug/release builds (NDEBUG, _DEBUG) (so you can't mix them - but I think this was done only for C++ - because of STL)
Let's make sure Heartbleed doesn't happen again.
yes and no. Javascript in the browser sort-of reminds me of a microkernel. Competing methods and implementations is a good thing. Having things that we think are fundamental be replacable gives us some freedom. Native implementations, from a performance perspective ... yes. Declaring "this is the reference for pattern X", not a big fan of that idea.
Well, the heavy load on CloudFlare's test server is probably making life harder by using up lots of RAM and filling it with uninteresting garbage, if nothing else. I'd be curious how a server with the same configuration but very light load fared.
ASK HN: What Sites do you read for tech news?
Hello,
I am a long time lurker and just signed up for an account today. I was wondering what sites you guys read for tech news/hackernews type sites? Thank you!
You two are talking about different things.

Analyzing something and making a judgment is fine. But what happens after you do that? If you just file it away, fine. But if you go out and publicly bash somebody with little thought for the circumstances, it makes you look like an asshole, and it is generally, as Oskarth says, and irrelevant and possibly harmful comment.

Open source software is a gift to the world. If somebody does a lot of work to give you something and the first thing out of your mouth is, "This sucks! What's wrong with you for giving me an imperfect gift?" then it comes across as ungrateful. Because it is. Worse, it makes the gift-giver less likely to keep giving.

If you want to offer feedback to an open-source project, first ask yourself, "Am I telling them anything they don't know?" If you think you are, then offer it in a spirit of gratitude and constructive criticism. And think hard about going beyond offering opinions to offering money or labor.
Why premium wordpress themes over free wordpress themes?
> I'd like to see how much of the NTIS revenue actually came from the real market.

The problem is that federal revenue doesn't come from the real market. Unlike (most) private businesses, they don't have to earn their customers and retain them through good service. There are usually no competitors and sometimes, through law, no alternatives.
Having viewed one of these mono 360 clips on an Occulus I would say it's a significant step up from watching it on a monitor. However you're right that a truly compelling experience will require full 3D reconstruction of the environment so you can render both eyes in realtime with head tracking.

That's probably feasible for some types of simple scenes but probably not a nature documentary.
LA Sheriffs launch a surveillance app that uses your photos and videos
My point was not at all that this is a poorly implemented code generator for Scotty. What I am arguing is that this whole category of tools are counterproductive for languages like Haskell that enable and emphasise good library design. There is nothing I (or any of the much more skilled Haskell programmers out there) could contribute to this tool to save it. It is beyond redemption.
This Crowdtilt will fund a focussed crowdsourced security assessment (otherwise
known as a bug bounty) on OpenSSL.
...
Security crowdsourcing company Bugcrowd will organize a “sprint bounty;”
coordinating and incentivising the security research community to thoroughly
test OpenSSL for potential security concerns.

I'm a little worried this is just PR move for Bugcrowd, but it might be genuinely useful in producing a bunch of bug reports for holes not discovered yet.

(Having said that, if you're a blackhat the amount you'd get selling or using anything you found would eclipse whatever Bugcrowd would pay you... But that'd happen regardless if this ran or not.)
Ensuring that valid certificates issued by them are only used by legitimate owners of the corresponding domains is their obligation.

Unfortunately, it seems as if Mozilla doesn’t care about the security of their users, otherwise this sorry excuse for a CA would have been dropped from their trust store already.
Same here,

HTTP/1.1 307 Temporary Redirect
Location: http://aws.amazon.com/s3