skysight-inc/HackerNews huggingface dataset:
Aggregate System and Application Logs with Papertrail
Excellent writeup but as long as the subject is marketing and memorability in names (and in particular domain names) kalzeumus (or is it kalzumeus) isn't the easiest name to remember for a blog or business.

And it lends itself to many typos which is one of my areas of expertise along with branding. I can't easily tell someone "just go to kal zum e us dot com" like I can "heart bleed" (which by the way has a typo that would leak in high volume traffic to "blead" a bit).

Other than that I agree with what Patrick is saying, although I did find the use of "heartbleed" with something also referred to as "heartbeat" (which of course wouldn't be available as a domain name) a bit confusing at first.
I think this just goes to show you the power that some well put together info graphics, attractive photography, and interesting content can get you. Even though it's a scam, they know how to package it correctly.
Its cheaper than budget of movie Gravity.
Why Google's Android OS is not all that open: Tech Weekly podcast
Thanks devinmontgomery. One of our greatest challenges has been striking the right balance between making detailed information available to those who seek it, and keeping our website presentation simple and easy to understand for newcomers.

Thus far, we've opted to display only one kind of interest rate (the simple flat rate upon which our website calculations are based), along with a modal box note that the equivalent APR is roughly twice this, and a prominent display of the actual dollar costs to the borrower.
A while back, I tried submitting a patch to OpenSSL. It was a 3-line change (IIRC) related to the build process - in a particular esoteric setup, the build failed. Got literally zero replies regarding the issue on the mailing list, their IRC channel and on my/their github pull request.

I'd love to contribute more often to other OSS projects. But this behavior is more common than not.
Crittercism Raises $30M, Inks Mobile App Performance Deal With Accenture
Ships and airplanes traditionally navigate using latitude/longitude measurements. Since that coordinate system is based on degrees/minutes/seconds of arc, a length unit that uses the same system is more natural.
The Loom of the Self
I presume this actually means IT contractors.
I have a friend who was thinking of starting a company a few years ago, but ended up joining a company as a salesman since that's what he could get. Maybe I'll see if he's heard anything about the growing startup culture.
Would the specific be the version of openssl being used by the 'target'?

Can't look right now but was this 'bug' introduced at some point in time?
So far, not so good. 60% of the funny is coming from the fact that Kumail Nanjiani is a great standup. It's Mike Judge, so I'm going to watch it all anyway, but if it were anyone else, it'd have 2 more episodes to get a lot better.
Welcome to a modern tech company :(
Meet Bossy, A Desktop Assistant That Wants You To Be A Better Worker
I found it interesting that it works at all given that it's using td elements as board cells, jQuery to compare dom elements for cell referencing/dereferencing, and setInterval to update the animation and gamer input.
I think the author has confused NP with NP-hard (or NP-complete). Indeed, it is extremely unlikely that the unknottedness problem is NP-complete, as it is already in NP ∩ co-NP (assuming the generalized Riemann hypothesis). Furthermore, we know that the problem of computing many knot invariants is "only" BQP-complete, so it's possible that unknottedness is in BQP (i.e., efficiently solvable by quantum computers), though I don't know the expert opinion on this.
The Secret Shame of an Unacquired Tech Worker
We'll look into that. Thanks again!
Ok, so this ceo supports an antigay candidate, and the Mozilla ceo supported one too. Yet this guy gets away with an apology and the other has been forced to resign?

Good to see everyone's equal sympathy towards others viewpoints.
List of demos: http://demo.famo.us/
Yes, a thousand times yes. The point isn't to market a vulnerability, the point is to get a fix out there.

Forcing the entire world to scramble is great marketing, but poor security. Vendors needed time to prep releases and communications; there's tons of confusion flying around out there.

Likewise, patio11's trying to capitalize on the awareness to market himself may also be great marketing, but it's bad advice.

I don't know why parent is being downvoted, either. This is simply not how you keep people secure. This is how you grandstand to promote yourself at the cost of other people's security.
Perhaps another way of saying this is that you will always need a runtime. And if you reimplement the portions of the runtime that you need in C, you've essentially re-implemented .NET.
What a great step forward from 2.x
The measurements of the chip log were recorded using a traverse board: http://en.wikipedia.org/wiki/Traverse_board
Business and software developer.

Codemonkey aka coder when Im feeling down.
Can you use HipChat for free for personal use or is it strictly enterprise?
Good, maybe they can spend some of that on fixing their god awful UX.
> We want to incite more people to audit and contribute to these projects, not the other way around

Prepare for some OSS heresy: in many projects, contributions are overrated.

Why? Presumably, the author is the one who feels the most joy/pain of what they've made. They're the ones who've had to grow and prune the code over time. They're the ones who've had to respond to features breaking their mental model sometime. They're the ones trying to make a cohesive abstraction. On crappy projects, the users shoulder more and more of this burden because the author did not.

I've had good luck with contributions in OSS (both making and accepting), but I realize a majority of them are "this isn't working for me, so I added this" without sitting down and considering it's effect on the entire design. I hate rejecting contributions, but if they compromise the project's modeling of the problem, or code quality, then it's for the better.

OSS lends itself to feature creep, just like commercial software. The marketing side of OSS rewards this, by incentivizing you to make more commits (such traction!) and accept changes from everyone (because, community!). New and shiny is a horrible heuristic to use when evaluating infrastructure (read: lots of OSS).
Where? And if Heartbleed took to long to figure out, how long did it take to decipher other security vulnerabilities? Don't compare it to a landing page of a consumer service, compare it to most other OSS announcements and projects.
And what about Google? and Amazon? And banks? And .gov sites?

I'm not sure how you can handle this in any different way as they did, really.
Hack me if you can
Too many crappy javascript-mandatory websites for that to work all the time, sadly.
Well, it didn't take HN/Reddit long to hug that site to death...

Google's cache link doesn't seem to be working. Anyone else got a cache?

Edit: Ah, no, this seems to work now: http://webcache.googleusercontent.com/search?q=cache:blog.ka...
The second graph (on workweek in hours) is really dodgy : the y-axis range from 38 hours to ... 38.8 hours. Not really a change then.

Also I would have liked to have the spread on both graphs, with the 10/90 percentiles.
I hardly think that a security hole, no matter how large, at a single web site, is on the same magnitude as one security hole that probably impacts the majority of web sites on the internet and could have been taken advantage of completely invisibly for years.
Yes please. Especially if it has a single browser option to disable all key rebinding.
This is probably on an annualized basis ($80k/year) and focused more on IT networking/computer consultants than say software developers.
I'm not sure that OpenSSL is the project they ought to be contributing to. It looks to be beyond repair architecturally (as a project as well as codebase).
I'm using an HP laptop (with Ubuntu/MacOS in VMs). Since I tend to work in different places with different lighting conditions, matte screen is a must for me, and it is not available on Macbooks.
Release notes for GHC 7.8.1
Yeah, I added an update to the bottom of the posting mentioning the possibility of generalizing it.
KeePass has a great autotype feature that perfectly bypasses that by simulating real keyboard input.

When it comes to anti-clipboard, I really hate sites that make you enter your email address twice (Which is retarded anyway; WHY THE FUCK would I not know/check what I am typing?; it's a cleartext field, you might as well have 2 fields for everything up to first name FFS...), then stop you copying emailfield1 to emailfield2. Fortunately, most still let me click and drag from 1 to 2.
I use KeePass' autotype.
We have no proof, but as such we have to assume that it's an NSA-directed compromise and take appropriate precautions, unless and until we have proof otherwise. That's why the NSA's actions really hurt.
> Because Cloudflare is possibly the biggest and most vulnerable target due to the enormous number of websites and businesses relying on it.

AWS is at least as important, as is Akamai.

My point being, it's not enough to hand-wave about who's the biggest and most important. A good system would give anyone with enough at risk a clear path to earn a seat at the table.

Major providers could create an "early warning disclosure club", each contributing some money annually, and the money can be used to pay bounties to anyone who gives them advance warning of a zero day. Of course you'd want some safeguards to make sure nobody blackhat joins the club to use the vulnerabilities for offense.
You can use the apps on mobile devices w/out the keyboard in a pinch, of course.

The way the apps are partitioned so they can't crap all over each others' DLLs and registry entries helps some as well. The single-source app store may or may not be a win for everyone, but making apps keep to themselves helps avoid fouling the whole OS install.
"Quora launched full text search of questions and answers on its website on March 20, 2013, and extended the feature to mobile devices in late May 2013. It also announced in May 2013 that all its metrics had grown 3X relative to the same time last year." [1]

[1] http://en.wikipedia.org/wiki/Quora#History
You don't travel on along a great circle when you driving or running. But when you are flying and sailing long distances, you do.
No, a thousand times no. It's pretty obvious big targets would be on top of this. But given the severity of this bug you need to get to the lazy sysadmin, to the small ecommerce owner that doesn't have an on site admin, etc.
In Haskell I can validate and be sure that I'm using "the proper type" in 100% operations - in C it's hard to verify that there is no code (intentional or accidental) that touches the inside of that struct in some way.

For example, C is full of operations (pointer arithmetic, read from an unbounded array) that may read the inside of that struct without that code mentioning that struct in any way.
A .bug TLD may actually work here.
Why coast when you can push? Yes, its a risk, but a lot of the time risk pays off. And, worst case scenario? You come out with more knowledge of yourself and your skillset, and a lot of businesses look at that fairly favorably.

Unless you're in Silicon Valley, age shouldn't be a factor. The only thing holding you back is yourself.
I'll see if I can fix this when I get a chance. If anyone knows how to fix it for apache 2.2 I'd appreciate it; I can nopaste my config.
Dash (OS X app for browsing APIs) for Linux/Windows
Likely worth $800MM given typical late stage funding multiples. #54 on www.thestartup100.com and notably most valuable company without any revenue.
At that point, speed isn't really the issue yet. Heartbleed was in the wild for two years. Would a day or two have made much difference? Highly unlikely.

Speed matters after the disclosure, when every petty criminal and script kiddy in the world is suddenly empowered.
I love the service, but it's about time Quora tested ways to monetize its site.
It discourages password manager use.
The Great Keyboard Layout Debate
Here's a pretty comprehensive salary guide, including geographic adjustments.

http://www.modis.com/clients/salary-guide/downloads/2013-sal...
> It seems like Python language is much easier to learn, with very clean syntax.

This is the kind of stuff that used to start flamewars on Usenet ha. I respect your personal opinion, but just to put a different opinion (mine) out there: I find Python very opinionated and feels kind of "old" (like, when was the last time an OO language required you to provide a reference to the object as a parameter within the methods?).

Also in my opinion, even now in 2014 it is still not clear what version of Python should people use 2.x or 3?, given that there is still a bunch of code out there that is not compatible with 3 (granted, there are tools to convert that code, but that makes just an additional step to do compared to just using Ruby).

All in all, these are just opinions. Both of the stands are very respectable, but I wanted to put this out to compare with your opinion. I don't use Rails, even though I use ruby a lot, so on those frameworks I cannot comment.
Erlang 17.0
How To Communicate Your Product Vision To Your Team in 5 Steps
https://www.airbackup.com/ ???
any of the iaso backup resellers? i kind suspect airbackup is one since it looks so much like iaso..
"Likewise, patio11's trying to capitalize on the awareness to market himself"

That's what I took away from this as well.
Maybe at the OS level? You have to trust the OS anyway so you don't loose anything. Allowing untrusted apps to do encryption makes auditing their activity much more difficult.
Sorry. My blog doesn't usually get this much traffic. ;-)

Trying to increase the number of servers but httpd isn't cooperating.
He should be reimbursed for the ignorant who forced him to leave his position.

People want tolerance towards their viewpoint, but will become so vile towards someone who doesn't agree with them? Yup, that needs to stop. Everyone is allowed to have their own opinion. This includes gays AND anti-gays.

Just by the simple fact that gays will not tolerate someone saying homosexuality is wrong, perfectly displays the point.
Ask HN: What should I do now on my free time?
Ive got a month or two of free time, and there is so many things I want to do, but how to prioritize?

I want to

* learn Scheme/Guile and help with Guix,
* another Java EE app to showcase my skills, but what should it do?
* make an Android app, to use the above Java web-service
* improve on Python skills, how? Ive made several flask apps, played with numpy when doing machine learning tutorials, dont want to learn domain-specific anymore like ML or "how to make a GUI app with pyside", but something more

How do you decide what to do and stick with it?

I just float from this idea to the next every day, one day Im toying with dis in python, next day installing guix and trying to understand .scm files, next day starting an appFuse project for a last.fm re-implementation.
So sites ought to list their unpatched vulnerabilities? Erm?
backblaze has 30 days retention only?
Does any one have a link to the actual data being discussed? They are big numbers but it doesn't necessarily seem to be (except in a handful of cases) outrageous. The numbers are just annual billings, not annual take-home pay, right?

For example, I just had a surgical procedure last week to have an otologist repair my eardrum. The breakdown in cost is:

Surgeon charge: 7,043
Facility charge: 10,200
Anesthesiology: 1,000

Now, the surgeon is very good at what he does and I feel he certainly deserves that $7000. His surgical schedule has him doing procedures twice a week, probably some more complicated than mine, and I'm sure he easily brings in several million dollars to his practice, some non-trivial amount of which comes from Medicare. Other specialties (like oncology and ophthalmology) are obviously going to make up a bigger share of the amount paid by Medicare because they are disproportionately treating older patients.

Until we know more, I think it's silly to be outraged about this.
How in the heck is this mess of a project so popular?
How to beat the “paradox of choice” in UI design 
“Less is more” is one of the most important minimalistic design principles every designer learns: you read about it a lot, you know it’s really important, but still you might get it all wrong. The important thing is to come around, learn from it, and evolve. And so we did.
"Your bosses / stakeholders / customers / family / etc also cannot immediately understand, on hearing the words “Rails YAML deserialization vulnerability”, that large portions of the Internet nearly died in fire."

I watched my colleagues working around the clock (not that bad as it sounds - we are scattered around the planet for a reason) patching servers, testing and ensuring every hatch is properly shut. I can imagine other teams all over the world and all over the internet doing the same, literally saving our civilization from a threat only a tiny percentage of the population had any idea existed and an even smaller group has any idea of how it threatened us.
This is mostly a useless article. What does the 42 an hour represent? Is it for independent contractors filing 10-99's and is that their bill rate or their EBITDA or their net income?

Is it the average for salaried workers? (avg hours per year divided by salary).

Did the average hours worked include only billable time or time spent on administrative tasks, company meetings and sales calls?

Did they include part time workers and did they properly weight their contribution to the averages or just lump them in?
perhaps crashplan..
Not really sure how it's possible to hang out on HN and not know who patio11/Patrick/Kalzumeus is...
does the AMA realize that if we follow their objections a to a logical conclusion that the American Public and Gov will ask to release more data not less?

Some context, Medicare rates and fess are not adjusted on a timely basis to adjust for changes in medical procedures and technology ..procedures become less time consuming to complete and things become less costly to have completed..

But that is only one context of many that has to be exposed and we need more data to do that

This is why the overhaul of Medicare data via the billing system is so vital to improving the benefit the government gets per dollar it spends on Medicare.

A very complex CS and Engineering problem that no statup has adequately tackled yet
This is a silly, unnecessary standard that will probably not be implemented by anyone.

Saying we need it and we need it now is simply ridiculous.
I went to their website, opisrael.com, yesterday and today. It's been counter-hacked by Israelis, and apparently it stays hacked when the Israelis do it.

There is a large security industry in Israel.
Update Techcrunch is now reporting the valuation at $900MM.
Here you go: 1.7GB uncompressed tab-delimited text, as a 414MB zipped download

http://www.cms.gov/Research-Statistics-Data-and-Systems/Stat...

(link goes to the overview download page with context, not directly to the ZIP)

Here's a good overview of the limitations of the data:

http://www.npr.org/blogs/thetwo-way/2014/04/09/300857727/dos...
Google discovered the bug.
Getting everyone on the same page and making sure that everyone stays that way, is a key thing to consider when building products.
The state of In-car UX
oh. and duplicati!
...then be a hacker and implement it right, rather than wanting an all in one 'solution' that compromises security for the sake of not requiring thought.
Relax. They have now switched to "post", and everything is just fine.
If a site knows it may have been compromised, it could simply force users to change their passwords on the next login. There is precedent for this (Adobe is one I recall), and it doesn't require any new smarts on the client side.
I would rather say...

If you're not using SSL right now, there's no rush to upgrade, but do it anyway while this is in the forefront because when you do use SSL one day on your server, you might forget that you had this old version of OpenSSL.
So, to keep this honest because these threads are still alive and active: In the end (like, just now) Gandi refunded the money - I have no pre-paid account anymore, after complaining they returned the money to me instead.

So pain points:

- user interface

- half of their TLDs are inaccessible, even for inbound transfers of the respective owner

- corporate sales team was .. useless and these business rules really don't smell like 'no bullshit' to me

Upsides (to be fair):

- support replied via mail to all my requests and was generally friendly

- I got my money back in the end (for transfers that didn't happen, so nothing lost on their side either, this is not a courtesy imo)
Sorry about that! I'll fix it when I get a chance
It's better to yourself get involved in drafting the rfc:s, if that is your thing, rather than throwing out insane accusations.
Amazing work, guys!
Can someone explain how there a place for Quora? The only niche I can think of is generic technical advise.

Stackoverflow answers all the tech questions but they are overly pedantic to the point of ridiculous when it comes to generic tech questions.

Hackernews should have been the correct place for generic tech advise but we don't see questions of that nature here. May be as far as tech advise goes people from startups would rather write blog posts and get some credibility for their companies rather than contribute anonymously.

So how is Quora relevant or can be? On top of that they only show you one question. So that boggles my mind as to why it can become popular if its gated to begin with.
The past, present, and future of open source and the internet
I had a content site from January 2011 until September 2013. From the first day until June 2013 I had less than 100 sign ups. Then I forced people to enter their email before the opaque screen is removed to allow click-through. The result: 8000+ emails from June to September..... Then I accidentally deleted my database (without backup).
You don't think for a second that the reason you were all working so hard to fix this is entirely because of the marketing? The intense marketing of Heartbleed alerted legit crackers (who would have found out anyway), and a thousand times worse, it alerted wannabe crackers of low hanging security exploit fruit.

Marketing works both ways, you know.
Learning today that the word "log" (as in event log or /var/log/messages) actually has roots in a physical log is mind blowing. I feel like when I was looking this up that there's a gigantic april fools prank being played on me.
I'm noticing this at work, too. Give things - even entire contexts - short, pronouncible names.

For example, at our place, "Munin" or recently "Graphite" have been established as the name for our monitoring systems. They describe a system spanning a couple hundreds servers, include a handful of different daemons and configurations and generally, a lot that's going on, so the term is inherently ambiguous and imprecise.

However, I've found that this takes a lot of pressure from the less involved people. They don't need to figure out how to call something precisely and correctly. They have an accepted, not entirely correct term that's precise enough to get the point across: "Munin on Server X broke" is all I need. Similarly, "Is our server X affected by Heartbleed?" might be a silly question because server X is no webserver, but it's easy to answer, because the question is precise enough and just on the right level.
I use CloudFlare (https://www.cloudflare.com/) on my blog - handles even the largest load HN has thrown at it.

Worth setting it up - just in case :-)
I also had some fun building a version of the snake game in JS some time ago http://komrade.github.io/snake/index.html
I'd be surprised if this was interesting to anybody except those who already invested a lot in IBM z infrastructure.