skysight-inc/HackerNews huggingface dataset:
There are a lot of questions that can't be asked on StackOverflow, especially ones that don't necessarily have a right or wrong answer.

HN is more focused on sharing news and less on asking questions, especially potentially silly ones.

On Quora, you can ask basically anything. It's like Yahoo! Answers, but with a much better interface.

It's a lot easier to ask a question on Quora than a place like reddit because you don't have to worry about finding the "correct" subreddit. Make a mistake with the wrong subreddit and you'll just be instantly downvoted and get nothing but joke responses.

That said, the site does have a Sillicon Valley "I want to be rich" twist to it, and I think it's necessary for that tendency to die off for the site to succeed in the long run. Far too many times have I looked at Quora only to see a lot of threads about getting rich, what's it like being rich, what would you do it you got rich overnight, what's it like to date someone richer than you, how do I be rich without being arrogant, etc.
I am but in the meantime I need to have food and shelter. I have some freelance work that can sustain me but I really wanted a reliable paycheck. I actually didn't mind the work and the company made a good product. I think the problem is that in the mind of the manager I attempted to plant in the head of the other employees ( many of which English is a second language and its hard to find work and they want to keep it) that you shouldn't just give away what is in your head for some one else to benefit. Its bad enough that they pay these people nothing but trying to scrape whats in their heads in exchange for remedial trinkets is really just seriously gross. If I was still in my 20's I would have just thought the whole thing was racist but I've been around enough to know that its really just corporate culture.
"Polar vortex" is not a proper name. Complaining about that is like complaining that we have given names to things like "buffer overflow bug" or "double free".

http://en.wikipedia.org/wiki/Polar_vortex
I Quit My Job to Become a Freelance Writer
This is (I hope) a once-in-a-lifetime incident, so we have to be careful not to extrapolate it too hard. On the other hand, it's seriously big deal. Overall, it seems to strongly challenge a couple of important assumptions.

As you say, it's a strong challenge to the mantra of "never implement your own crypto". I think (think) it still holds for the crypto primitives. If you're reimplementing AES you're probably doing it wrong. But the protocols? I'm not so sure now. Common wisdom seemed to be that if you implement the protocols yourself you'd screw them up, and you should stick with tried-and-true existing implementations. Now it's apparent that "tried" doesn't have to imply "true". Something being used by millions of people for years doesn't prevent it from having a huge vulnerability for years. Are your odds better or worse rolling your own? I'm not so sure now.

Consider Apple's "goto fail" bug, for example. Among a lot of other stuff, they caught some criticism for reimplementing TLS instead of just using OpenSSL. Well, if they had used OpenSSL instead, it turns out that they would have been shipping an even more serious bug for even more time.

It's also interesting to me how it challenges the idea of encrypting stuff by default. For years, people have been saying that as much traffic as possible should be encrypted, even unimportant stuff that nobody cares about. By doing that, the idea goes, using encryption isn't suspicious and you force attackers to spread out their resources. If only a small amount of traffic is encrypted, attackers can focus just on that traffic. Accordingly, a lot of sites that didn't really need it enabled SSL or even required it, including my own. By doing this, a lot of them inadvertently made things much much worse. A site that's only accessible over HTTP is much better off than a site that's accessible over HTTPS but vulnerable to heartbleed. I don't think the general idea is wrong, but it certainly gives me pause, and I think more consideration has to be given to the increase in attack surface you take on when you enable encryption.

In any case, I really hope we see some new crypto projects come out of this, or more resources put into existing OpenSSL alternatives.
I'm pretty sure they are including buy-and-bill numbers here. The #1 doctor, Salomon Melgen, is a retinologist who is currently being investigated by CMS for suspected Medicare fraud. The numbers in this article match the numbers from the CMS data dump.

See http://www.breitbart.com/Big-Government/2013/02/14/Medical-E...
(author here)

Getting around timing attacks is not too different in Haskell from doing the same thing in C. First, there's 2 different classes of timing issues:

1) cryptographic ones

2) and the others (for the lack of better classification)

For cryptographic ones, it's hard to enumerate all the counter measures used/not used, but some examples:

- use of blinding with RSA

- with ghc 7.8, exponiantiation is using GMP expmod_safe

- AES is using native instruction when possible.

- Use of scrubbed memory/memory constant where possible

- some lowlevel cryptographic implementations are actually in C (hash, aes, ..)

Also, while I'm linking against specific set of cryptographic implementations by default, there's nothing preventing anyone from pulling different crypto implementations from other places.

For the other issues, it's usually just a deal of strictness, and not bailing/notifying error too early.
(e.g. This is what Bleinchenbacher and CRIME are all about).

- data comparaison is time constant by comparing all bytes where necessary: prevent padding attack

- there's routines to evaluate boolean values without bailing too early (False && ... -> would bail at the first false)

- lots of part in tls is using strict bytestring, and strict values.

- the GC is adding a lot of noise potentially hiding timing issues, potentially exacerbated by pure values instead of mutable values (like you would in C)

Also, I don't want to claim there's no issues or ever will be. Hopefully there's no such things, but I welcome any audits and questions about stuff that look fishy. But people shouldn't only looks at the cryptographic side of security; openssl had so many issues about basic unchecked values, buffer underflow, overflow that's not even funny anymore. Just sayin'
Yep, I see no discrimination based on sex or race, which we know is illegal for sure. They can simply fire you if they want to, otherwise. I wouldn't be too beaten up about it though.. Doesn't look like the best place to work.
You are correct. That is an exceedingly insightful point that I hadn't considered.

This is exactly why I appreciate HN. Thanks for sharing.
Probably not anything you can do. Find a new job.

It will be interesting to see whether the people rallying to Eich's free speech rights despite his homophobia will be similarly impassioned about rallying to yours despite your rejection of serfdom.
I'm an American who went through cancer treatment in Korea. AMA
Especially if you're working independently. You've gotta cover all your costs, including insurance and retirement. That usually puts a well oiled consultant up over the $150/hr mark.
regardless of where in the world you live, say no.

How do you know this? I've gotten pushback in a top-20 (but not top-5) US city on that, even for appsec work.
Peter Gregory was clearly based on Peter Thiel
The context is America's constitution, in which case it specifically is freedom from state mandated consequences.

there is a worry that his stepping down represents a degradation of his right to Free Speech, as enshrined in his country’s constitution.

Under that context, the article is spot on. If you widen the sorts of freedoms your talking about, as I think some of the people were when talking about this situation, then it all becomes a big tangled mess. If you give one person freedom, you're taking it away from someone else.

It is perhaps a worthwhile discussion to have, but it's still important to note that specifically the American constitution doesn't protect you from people telling you you're being a bellend.
It is a really good Q&A site.

I was a Quora Top Writer in 2012 and 2013, and I've also built a lot of web stuff and spent a lot of time studying web communities. Purely from a craftsmanship perspective, they've done an incredible job. The visual design, the interaction design, the writing and reading experiences, the social incentives, the notification system: all of it is top notch.

That said, I have never understood what their economic plan is. I have a very good understanding of the economics of content businesses, and the people at Quora are either incredible geniuses or totally nuts. Since they won't say how they plan to make money, we can't say. If I had to bet, It be "totally nuts", just because so many content businesses get seduced by a creative vision that current revenue streams just can't support. But having met some of them, I know they're very smart, so I am hoping that I am wrong and that they have some clever monetization strategy that will let them justify their very large valuation.
The "Heartbleed" security vulnerability – how we're communicating to our users
Small e-commerce sites and lazy sysadmins are probably running such old, outdated versions of OpenSSL that they aren't vulnerable to this bug anyway.
Noone disputes his tech skills or contribution. You're missing the point here.
What will be the easiest way to get GHC 7.8.1 running alongside the official GHC packages for Debian (specifically Jessie)?

Should I download a package from http://deb.haskell.org/? If so, where can I find 7.8.1?
Erlang OTP 17.0 has been released
OP's point is that the onus is on the library developer to not just use Int. You're treating it like the library developer is a user of another library.
Just Found Is Twitter testing a new UI-Design?
It is one option, there is also

https://bugcrowd.com mainly paid reward programs, can start using it for a bug bounty/rewards program for free (also maintains the bug bounty list which is used by many white hat hackers https://bugcrowd.com/list-of-bug-bounty-programs/)

https://crowdcurity.com
He did because this is the worst internet bug in the past 10 years, not because the page was so masterfully written. Private keys and user passwords/data being disclosed will be cared about by systems administrators even without such a fancy page.
There is a place for Quora because it has helped build a community of users that provide extremely valuable advice / answers in a nicely presented format. I'd pay atleast $10 USD per month to save Quora if there ever was need for it.

Unlike reddit or yahoo answers, answers are often provided by real members as opposed to hollow or anonymous accounts and it also serves as a collective wisdom center for past experiences of other humans that you can refer to.

I'm unsure what the correct mix is, but Quora is at the sweet spot of:

twitter + r/askreddit + yahoo answers + ask HN

-> Want to know how to transition from engineer to a job at a VC firm? Well you have folks like Leo Polovets (Current VC, early Linkedin employee /Engineer at Google, Factual) provide extremely detailed answers that are well written and more or less permanent. You know the dude is qualified and is somewhat credible [0].

-> Want to know how Stripe got its name? Well you are in luck because Stripe CTO tells you exactly how [1].

-> Where else can you ask about the evolutionary purpose of menstruationand get a response from a PhD in Zoology? You know its on Quora [2] (unless you want to get trolled on reddit).

[0] http://www.quora.com/How-does-one-move-from-being-an-enginee...

[1] http://www.quora.com/Stripe-company/How-did-Stripe-come-up-w...

[2] http://www.quora.com/Menstruation/What-is-the-evolutionary-o...
One of their killer features is the weekly email digest. Find questions that have good answers, and then promote them to users who have said they are interested in that type of content.
I count 2080 work hours... where are your other 100 going?

52x5x8 = 2080
Fresh Startups – Public Beta
As an aside, I am delighted that there are 4 million people learning English from somebody who uses the phrase "pickled fucks". They are, and I mean this sincerely, in very good hands.
Whew. Good thing I don't run such a service. :-) (Edited my comment to better emphasize that it was hypothetical.)
I'm glad I'm not the only one. I was really excited about this show (big fan of Mike Judge in general) but it feels like what someone would think SV was like if they based their entire impression on Techcrunch articles and 80s nerd / guru tropes.
> Java is advocated as being a much "safer" language, but how many exploits have we seen in the JRE?

Very few. I don't think I can remember ever seeing an advisory for Java's SSL implementation.

Yes, bugs are possible in all languages, but that doesn't mean there's no difference between languages. I'm reminded of Asimov: "When people thought the earth was flat, they were wrong. When people thought the earth was spherical, they were wrong. But if you think that thinking the earth is spherical is just as wrong as thinking the earth is flat, then your view is wronger than both of them put together."

(There are a large number of bugs in the browser plugin used for java applets, but they have no relation to the JRE itself)
There is absolutely no basis for such an inference. It could have been a one off job, he could be undercover, etc. In fact if I were a clandestine organization I would definitely try to recruit people from other countries to make matters appear less obvious.
I do like their simple form and layout, they have indeed got an elegant site. Nice piece of UX engineering without a doubt.

There can't (in my v. humble opinion) be any realistic way of recouping 80 million from a Q&A site. They would surely need to be extremely aggressive at the least.
Ants Build Complex Structures With a Few Simple Rules
Typically AWS is great at communicating with post-mortems, for example: http://aws.amazon.com/message/2329B7/

In this case, they probably didn't want to be too explicit about the details of patching tens of thousands of machines while the remediation was still ongoing.

I do agree that it's unexpectedly hard to find a link to the "security notice" page anywhere.
"Safer" is an interesting adjective: its meaning depends on your threat model. Are you more worried about underestimating the already-tarnished honor of a secretive federal agency, or about being screwed over by that same agency? I personally care more about the latter.
the twitter app is 30M, we have already past the point of sensible app sizes.
edit: fb messenger is 60M, a ghc-ios app with the elm compiler baked in is 24M.
That bothered me at first, but remember that it's not the tech that's the point of the show, it's the culture. Who's on First isn't about baseball.
I'm not sure I'm convinced of the payment model...

Charging for human interaction seems like a losing proposition... What's to stop a competitor from coming along, doing the same thing, but removing the cost?

And what does the cost represent? Server drain? use of the drawing platform? there's gotta be a better business model out there... maybe you can integrate with amazon and make this a more general read-with-friends kind of thing and sell the reading pattern data (that seems like it would be valuable to companies like amazon or barnes & noble)...?
Well this is a life lesson learned: don't mess with upper management. What they are doing is exploiting their workforce (I mean c'mon a guy saves them $5000/mo and he gets a $50 pizza party?) and the only thing you can do is privately share your discontent behind their backs. Most companies are not open to disruption especially by petty labor.
You're right, I actually have an account with them and remember setting up the client-side certificate. I completely forgot about it afterwards. I would say that "rather confusing" is a deep understatement. The process, at least on the Mac, is atrocious and makes this method only suitable for the most advanced users, and even then only if you're willing to take on only the most enthusiastic.
Show HN: Volley
This gave me a good laugh, thank you :D
It's always fun to hear non-Christians tell Christians what they should believe. You cling to that straw man, but the fact of the matter is that nobody holds all those laws from Leviticus anymore. And for good reason.
You can contact the Department of Labor (http://www.labor.ca.gov/), but I seriously doubt what they did has any legal consequence.

I don't know about CA specifically, but Departments of Labor usually LOVE aggressively defending employees' rights. Something I don't see much on HN, but I saw a LOT when I worked in HR.
You may qualify for pro-bono advice: check if any local universities offer free legal advice clinics.
When you want to switch platforms and “redesign” too? Don’t
I'd rather they just fix the problem than tell me detailed bedtime stories.
Build Software for Lazy People, You will Make Money
"Catastrophic" is the right word. On the scale of 1 to 10, this is an 11.

No, it's not. If you asked me — I was a CISO not many years ago — I'd call this an 8. Schneier means well, but he has a tendency to exaggerate. (Here is an example of him suggesting that SOAP and other web services never be used because they "sneak" through HTTP and are therefore inherently insecure: https://www.schneier.com/crypto-gram-0006.html#SOAP)

A 10 would be a case where a bug was not easily patched, and gave complete control of servers to any interested script kiddie. Thousands or millions of web users would have had enough information for credit card and identity theft to be acted on before the hole could be plugged.

This is not that case. And it's certainly not an "11". Most vital websites have either already been patched or are about to be.

We can now keep calm and carry on.
It's all about characters. If they're able to create an audience connection with characters, the show will be long lasting.

Entourage (this show's closest comparison) had some pretty stupid episodes (the last season in particular was awful), but I stuck through it all because I liked Ari and Drama.
Depends on the economics of your business. It could be more profitable to lose some of the easily annoyed if you can get the rest to come back on a more regular basis via email contact.

But yeah, that's a big bone of contention both inside and outside Quora. The people who write a lot on Quora generally hate it, because it limits their audience. The Quora management, though, believe it is strongly to their advantage. They've never published stats or even their full reasoning, but they are quite firm in their belief that their data shows it working for them.
1. That is not what right-to-work laws are for, nor is what you described any definition of right-to-work.

2. CA is an at-will employment state. You can be terminated for cause, no cause or just cause.
Neel Mehta: "...private key exposure unlikely" [Heartbleed]
I started working as a tech consultant in my teens (not just building PCs for friends but actually developing relationships with local small businesses, translating tech-speak for them and advising them on the best course of action for things like servers, backups, security, and networking) and my hourly rate started at $35/hr.

Within a few years the demand for my services outstepped the number of hours in my day, so I pushed my rates up, peaking around $75/hr in my early 20s when I finally got sick of dealing with people who wanted a magician instead of a tech consultant.

That was about 10 years ago. I have friends who stuck with it and every single one of them makes more than $100/hr, so I laughed when I saw this article say, "the average hourly salary for tech consultants hit $42.17 in February—an all-time high."

It does say "average hourly salary", but I wonder what percentage of tech consultants work for a salary vs billing the client by the hour.
This sounds pretty awesome, does anyone know of a co-working place similar in Tokyo?
I think its only the first episode to attract viewers. I was surprised when I noticed they were airing this season's first episode of Game of Thrones on Xbox for free with no registration/app download requirements. Glad to see content publishers "getting" the marketing angle.
That's a really good thought -- If anyone can pull this off, it's likely Judge. I've never seen a pilot that wasn't at least a slight bit awkward too, so as I said above, I'll definitely give Judge the benefit of the doubt for a while at least.
JQuery Plugins for Manipulating World Maps
If you bill 38,8 hours/week you need to spend ~55 hours in front of the computer every week. Sometimes it's hard just to bill 30 hours...
And $42/hour for US contractors it's surprisingly low.
For a moment I though I add clicked on my Slashdot bookmark ...
I think the parent poster meant "At-will" rather than right-to-work.
I'm skeptical for these ophthalmologists to be billing those numbers and NOT include the average sales price (ASP) of their injectable drugs.

For those looking in, ASP is how medicare reimburses outpatient drugs. The physician practice buys the drugs up front, then bills Medicare the "average sales price" + 6%. The issue at hand is that Lucentis runs $2120 per injection. If you have a decent or large sized macular degeneration patient population, you'll be doing a lot of these injections. However, the number the practice collects is $320. Out of that number, you have to pay overhead / office staff / supplies etc.
Its a shame. This is exactly the group of people that could guide you in the correct direction. But I guess that is a lot to share for companies. I for one would have loved to see answers to that question myself. Did you post it on Quora and did you get any responses there? If so can you paste the link here?
Hosted chatbots for your team.
>Would a clause in LGPLv3 that exempts the publisher/distributor from limitations beyond their control (console/iOS restrictions) help?

I doubt very much that RMS would want to add such a clause. Remember, the GPL and LGPL are political tools as much as software licences. They exist to move the world in a certain direction. Adding such clauses would reduce their reason for existing.
I know it sucks because you probably need that $8/hour right at this point but in the grand scheme, the "pizza party" and "wheel of fish" is about the most humiliating ridiculousness I've heard in quite some time. Life is too damn short.

Just reading the small amount you've written about the situation, I can tell you that you simply write English at a greater than $8/hour level. Probably much greater.

I'm continually shocked at how aggressively companies court mediocrity and failure. They probably think they are extremely progressive even for listening to employees in the first place, double plus points for giving token rewards. Unless, of course, that the employee input happens to be about how ridiculous and juvenile the whole exercise is.
Yes, not notifying at least the big linux distros and BSD projects was quite irresponsible. Everyone except for a few chosen service providers like cloudflare was thrown under a bus here.
That was probably the part I laughed the hardest at.
Even better, if you use vector library, prefetch instructions are automatically (and nearly optimally) inserted for your loops written in higher-order functions like fold.

Details here: http://research.microsoft.com/en-us/um/people/simonpj/papers...