skysight-inc/HackerNews huggingface dataset:
Ask HN: Stick with it or get out?
I am sure most of you will understand my reason to remain anonymous in this post, with that said: I have been offered the following post, and am deliberating on its acceptance, your help would be very much appreciated.

Firstly, whoami: https://news.ycombinator.com/user?id=developer786

I am not a born coder, I know that, therefore for the second post, I will be working very very hard. Where I am currently, I am very comfortable.

Current Post
- Windows/Linux Administrator / DevOP
- Small Private Healthcare company with good financial backing / profitable.
- Job Security: Medium/High - Environment: Working with a team of 30 2nd and 3rd line support
- No Stock options
- Salary: $63K
- The role: Little development, lots of Linux Admin, training in any sysadmin courses provided once every a years, Ruby training course provided soon.

New Post
- Developer(bash/php/ruby/python) / Linux Administrator
- Telecommunications company with investor backing / breaking even.
- Job Security: Low/Medium - Environment: Working From Home
- No Stock options
- Salary: $75K+8K bonus
- The role: Developing bespoke applications in the above languages for a range of customer requirements. Developing and extending Linux based applications.

Your help, If I don't get to thank you later, is very much appreciated.
$299 3D printer achieves Kickstarter goal in minutes
Some companies see a degree as a must, some will offer you less money if you don't have one, and a growing number don't care. (Since a degree hardly makes you stand out anymore.) You will probably be surprised at how many companies follow this formula: "we need this > you can build this > you're hired". (And that is the only thing they go on.)

If it was me, I would just lie and say I have a degree. Keep applying until you find a company that doesn't check. If you are smart and talented, no one will think twice. Even if they do, there's a chance you'll be entrenched in the position and they won't want the cost of replacing you any way. Don't be scared, just always think about your options and choices, especially the unconventional/controversial ones...
One of the dumbest I've run into is to jack ctrl-f and send it to a site search box. If I use ctrl-f, it's because I meant to do an entirely different thing, or by accident. In no case is it because I want to search your article archives.
He's running on a Windows box?[IIS]
The advice of this article is good, but I don't think it should be up to individual website authors to behave well. Ideally, there ought to be a standardized javascript API for binding control keys. Then the browser could prohibit rebinding if desired (while giving feedback to the webapp as to whether rebinding was allowed), and provide an accompanying UI for the user to see which controls are enabled/disabled, to whitelist or blacklist websites, and so on.
Three Major Challenges for the Internet of Things
To get more women in tech, we need to start at school
Amazon FireTV
Macs just work. I was an Ubuntu user for over 10 years, first on an older Thinkpad (rock solid but eventually slow), later on a decent HP (with a little hardware problem).

I bought Airs for my wife and daughter. I would help them with something, then return to my machine, and feel a little more frustrated each time.

Airs have better hardware, better software, a better user experience, and are rock solid (if you don't hit them too hard). They don't get in your way, they just do their thing.

Macs are no-fuss machines that allow you to do your work without requiring you to babysit the machine. I'm no fanboi, I just recognize quality when I use it.
Most of this post is wrong to one degree or another.

Ignore it.
17 Untapped Backlink Sources
Medicare Millionaires Emerge in Data on Doctor Payments
I guess it is a matter of how both communities look into the problems.

Currently I spend more time on D forums than Rust ones, and to be honest given my type of work I can only use JVM/.NET/C++ languages, as customers have the last word.

However as language/compiler geek I do follow many discussions.

Trying to avoid a flamewar here.

D has a GC and follows the school of thought from Cedar, Oberon, Modula-3 and so forth, where it is assumed you can have a systems programming language with GC, which also allows for manual allocation when required to do so.

Still room to improvement there in terms of performance, though.

Rust leaves GC to the library, at the expense of a complexer type system as a means to allow the compiler to reason about automatic memory usage.

Both provide very powerful and modern abstraction mechanisms.

Which one is better? I think it is a question of use cases.
This is a bit like a footballer saying they don't get sports like golf, or marathon running. Fair enough. They are very different things. You wouldn't expect a devotee of one to enjoy the other.
Sesame Street gets how people want to watch (and pay for) TV; HBO doesn't
The thing AWS does which can be described as amateur, was the communication. AWS has always been really quiet when there's an issue on their services.

It's a nightmare to know when your problem is due to your infrastructure or if their's a bigger scale issue at AWS cause they never talk about it...
Not this one: http://eprint.iacr.org/2014/161.pdf
★Any stats showing "interest graph" monetizes better than "social graph"?
Would be grateful for any responses. Especially interested in numbers, rather than just opinions. Thanks!
The problem is not that sites are choosing to override browser shortcuts, but that they can do so at all. The browser should not allow its shortcuts to be overridden. In Vimperator you have to enter a pass-through mode, so this kind of overlap never happens.
This looks interesting. So when can I try this?
Now we have exploits for libraries and runtimes that often allow access to arbitrary application data. If this functionality is in a separate process without such privileges, application data will be safe.

This will prevent the prior vulnerability. Will it prevent the next one? Do you know what it won't make the next vulnerability worse?

A year or two ago I had to deal with a bunch of people complaining that the embedded device my team was selling was vulnerable to BEAST, because their scanning tool told them it was. I wrote a long essay for the support team about how BEAST is exploited and it's really hard to do it against a limited purpose control GUI with no publicly routeable address, and this worked for about half the people who complained. For the others we had to turn on RC4, which may have been even worse, but now their tool wasn't complaining at them so they were happy, even though they may have been worse off.

Thankfully my old team didn't rush to the new OpenSSL version so they got to avoid the past 48 hours being complete shit for them.

There aren't clean answers. Like with financial regulation, what you do to make sure the last thing never happens again may create the next thing.
This seems highly pedantic and nitpicky. It seems like you're looking for things to criticize.

Use of Heroku as an example of communications leadership is misplaced. I have had support request sit around unanswered for days in Heroku. Don't get me wrong - I love Heroku. But you have to pay them an arm and a leg monthly in order to get quick support response time. AWS, on the other hand, seems very responsive to all requests.
Schneier.com Has Moved

As of March 3rd, Schneier.com has moved to a new server. If you've used a
hosts file to map www.schneier.com to a fixed IP address, you'll need to
either update the IP to 204.11.247.93, or remove the line. Otherwise,
either your software or your name server is hanging on to old DNS
information much longer than it should.

Ok, how should I "authenticate" that the site at the new address is the "real" one?

I know, I'll use OpenSSL and HTTPS!
I wanted to use a random password, unable to paste it, I pasted it into my firstname field and just typed while reading it from there.

Anyways, I forgot to remove it again so now my first name is <firstname><oldpassword>.

You can't change your name after your account has been created.
CandySwipe
If you go that way there is also MD2_Update, MD4_Update and MD5_Update, that are also one typo away of a bug you can't miss at all if you test anything.

Of the many many faults of the OpenSSL API you just didn't chose the right one.
yea something like that. I love MMM. I'm pretty frugal but I don't save 90% though. However, I make a good bit, have already been working a few years so have a nice base. I'm targeting the $1.5 million range, then move somewhere cheaper and live like a king.
Brain '15-second delay' shields us from hallucinogenic experience
It could be that some people use password managers that require pasting. (though many don't) It could lead to people using passwords that are easier to remember if their password manager doesn't work.
Yeah, it seems the first post about it on HN was over a year ago. I suppose that's a good enough time for a controlled test release. Will be exciting to see this in the wild.
I think the intended implication is that he would be an agent for the NSA within that firm. Your second sentence stands however.
As much as I disagree with it, it's not that rare. Steam does the same erroneous distinction, as well.
While the author is perhaps overly critical of the response of AWS to this issue, he has a point. When your business is suffering from an issue related to your provider and your customers are calling every 10 minutes to ask when you are going to fix it, you need your service provider to give you as much timely information as possible so you can relay it to your customers. The best thing they could have done would have been to provide gratuitous, empty information, every half hour. Even just saying "we're still working on it folks but no new information" will keep people calm and provide needed feedback for concerned individuals.
"My weapon of choice is Python."
Cool way to put it.
A lot of people that use password managers don't know their passwords (I only know a few of mine). Maybe calling it a flaw is too severe, but it isn't doing those folks any good.
PayPal is also doing this in their "change password" form.
Free as in?
Software Gets the World to Stop (Over) Eating
In highly developed countries there is a lot of discussion about the large disparity between the poor and the rich, but India seems to dwarf just everything by orders of magnitude. Every time I read about India's space program I am just unable to comprehend how a nation can at the same time fly to Mars and have a large part of their population live in slums.

UPDATE: I just want to clarify - I don't want to judge this as good or bad, I just want to express that I am unable to bend my mind around that.
Many thanks for the response. It's also what I observe other mobile-centric people around me do. They don't spend a ton of time in the browser, but they do use it. It's encouraging, in a way. Sort of like a slow computing movement.
I would imagine it is 'optimised for verification' rather than for speed, ie. the code will be written to follow the structure of the specification.

However, the nice thing about having a verified implementation is that it can be used as the specification (reference implementation) for any other optimisations you want to make.

Such a two-step process is usually much more tractable than trying to verify optimised code directly. This is used extensively by BedRock ( http://plv.csail.mit.edu/bedrock/ ) which uses functional programs as specifications and an assembly-like language for the "real"/optimised implementation. The resulting verification problems are straightforward enough to be mostly automated.
Jasper: an open source platform for building voice controlled apps
If it was your sole purpose in life to bust dams, and then suddenly you were given a cache of unlimited dynamite...what would you do?

To the point, when the nature of a thing is to foo and you remove all obstacles from that event, expect positive feedback...and lots of it.
Feeling "insulted" hardly seems reasonable. Perhaps better wording should be used on the site, and indeed the use of "Mac" and "PC" seem a little off, but declaring that you are insulted by the author's choice of words is more childish than constructive.

To the author: consider using OS names instead.
Here's my response: nerds focus on long-term optimization whereas jocks focus on premature optimization (in computer science speak, think "Big O" values for 10,000n vs 2^n).

As a result, nerds are seen as low value at the present and subconsciously remind jocks that their maximum values are relatively low in the long term.
Show HN: Learning SICP with Understudy
Quora Raises $80M Led by Tiger Global, Now Valued at $900M
Maybe that should be Mac®...

It's pretty clear that PC in this context means Windows. In the install docs, they mention "Windows" by name as a section heading. It could easily be an SEO thing, having the word Windows on the landing page is bad for business.

To answer your question I think maybe yes, you are the only one.
I'm familiar with the paradigm. I've written some code to talk to dodgy embedded devices that don't "talk" unless they have something to say and I have ended up having to use timers. It sucks, to be sure.

I looked back to RFC1122 to get a feel for the nature of TCP keepalives, and I would agree that they're unsuitable for this application.

If we posit that a keepalive mechanism is useful for TLS I'd still argue that a payload is unnecessary because TCP will handle in-order delivery. A NOOP with some random-length padding would have worked just as well.
It's bullshit.

I'm 100% positive that many targets have had their keys extracted, but it's hard-to-impossible for the attacker to choose what fragment of memory the server returns, and it depends heavily on the server in question. What works against nginx won't work against lighttpd or apache.

I hit a site I control repeatedly yesterday and couldn't even get any common byte-arrays in common across hundreds of connections.

Of course, as good practice, all organizations should treat their keys as compromised and issue new ones.

Also, his "it leaves no trace" is a problem. It's trivial to recognize the traffic pattern.
Rust and D will largely inhabit the same conceptual space (both can easily be used to write efficent, low-level programs) but their individual styles are so different that I think in practice any given programmer will have a clear preference for one or the other, with little overlap between the communities.

Rust has an overriding emphasis on guaranteeing memory safety and correctness, and when the programmer must resort to potentially unsafe code it isolates the unsafe portions of the source code so that they can be more easily audited by hand and thoroughly tested. It specifically incorporates safety features with zero runtime overhead (with the exception of array bounds checking, which can be turned off on a case-by-case basis) in order to appeal to C++ programmers who need to work close to the metal.

D also emphasizes greater safety than C++, but not to the fanatical degree that Rust does. D smooths and streamlines the experience of writing C++-level code and favors expressiveness, with especially impressive compile-time programming abilities.

The most important conceptual division between D and Rust is that D guarantees memory safety via garbage collection (which can be disabled, at the cost of losing memory safety), whereas Rust guarantees memory safety via compile-time checks (which makes Rust code less convenient to write, since it forces you to think about the lifetimes of your data, but provides the benefits of memory safety in environments where GC overhead is unacceptable or where the code must run without an accompanying runtime present).

Both languages share many similarities to C++, but this is merely convergent evolution. D deliberately began with a very strong C++ influence, whereas Rust began as more of an OCaml-like language and gradually evolved toward C++ due to the pressures of designing a production-grade systems language. The result is that Rust favors ideas more prevalent in functional languages: immutability-by-default, algebraic data types, everything-is-an-expression, and so on.

A good oversimplification might be something like: D was conceived by people who were tired of how clunky C++ is. Rust was conceived by people who were tired of how unsafe C++ is.
Tips and Tricks Learned Releasing an Hybrid App Using Steroids.js
Looks great, no pricing though? Also what would be interesting is what the different datasources that I can/need to plugin.
So they are amateurs because;

- They managed to create and test a deployment procedure in a couple of hours.
- Deployed this update to thousands of machines spread into multiple continents in 48 hours.
- There were no downtimes. No action required from customers.
- Eveything seems to in in order now.

Yeah.. I hope they die in a fire.
Also, how does issuing a new certificate work with certificate pinning, whether tack.io or built into the browser?

I was working on a standalone certificate checker last year but couldn't figure this one out.
> Now we have exploits for libraries and runtimes that often allow access to arbitrary application data. If this functionality is in a separate process without such privileges, application data will be safe.

Even now if OpenSSL would not have made their own memory manager focusing on performance this bug would not have such major consequences.

Frankly they should just accept performance penalties and make a memory manager that focuses on security.

As an example all allocations should be from mmap so that any overflow will automatically segfault (with checks that one doesn't get continuous pages from the OS unmapping selectively to create disjoint areas). Every free should be a munmap etc.

I do also agree that moving this to a separate process would be useful.
Ask HN: What to do with monthly Azure credits?
Hi,

I have a MSDN Ultimate subscription that comes with ~€110 per month of Azure credits. Right now I don't have any projects yet that I can host on Azure, but I really love Azure and I'd love to put those resources to good use.

Does anyone have some good ideas for things that I can run? €110/month is enough for around 10 servers.
The nice thing about this example is that you only need GHC to create the shared library, and then GCC can do the rest with just the .so file produced.
I found out about it maybe six weeks ago and have been using it ever since, pretty much every day. Extremely useful.
> No, but they are kinda close.

They're kinda close but kinda far as well, supporting an anti-gay candidate may be because

* you have the same views on the subject

* you are not aware of his views (but you can be criticised for lack of due diligence)

* you are aware of his views but support him for other reasons

* you are aware of his views but absolutely don't want the other guy (similar but not identical to 3, you're not supporting a specific candidate so much as supporting anyone other than a candidate)

Of these, only #1 is close to the prop8 situation.
Nice to meet you. I'm your hard pressed example, there are millions like me in the US.
Amazon has a status page for all AWS services and provides RSS feeds for each: http://status.aws.amazon.com/
Q&A site Quora raises $80M to build the next Wikipedia
https://code.google.com/p/chromium/issues/detail?id=291258#c...

Also Chrome’s speech API only sends audio to Google, "sites" only get a transcript.
Quora collects $80 million in funding
Why is speed at sea measured in knots?
An HTML5 snake game in 7 minutes using Ludus (Amber Smalltalk)
I've been doing IT for ~13 years.

When I first started in my late teens, I was a hard core Linux user. I then moved over to a Thinkpad T40 (which I loved, and still have in a box to this day, with Windows XP on it).

About 4 years ago, I was issued a Macbook Pro while doing work at a DOE lab; I've never gone back since. It just works (as /u/PeterWhittaker stated). I've since bought my parents and my wife Air's.

I really didn't add significantly to the above comment, but wanted to be more verbose than "THIS". There is so much value in a tool that "just works".
Without looking at the specifics, the CA can't be held responsible for you leaking the key yourself.

Or do you mean if the CA companies themselves were compromised? That's a big separate issue. Even if the web process is the one that generates the keys (I'm skeptical, but it's possible), any keys made that way would quickly be moved out memory, unless they were made that day.
The way they communicated it was very, very amateurish. They needed to know when they could re-key their certs - seems like it was impossible to tell. That's something that needed to be done ASAP. Without knowing precisely when the environment that affected them was updated, this client couldn't get that done as quickly as they might have.
Careful with these goalposts, you're destroying the turf.
It's not RT, it's full Windows. You can load whatever Windows programs you want.
hey, apple fanboys pay heavy upcharges for all their "not PC" devices & for that they earn the privilege of shaping the marketing vocabulary landscape XD
I'm sorry if I wasn't clear. With the appropriate types in Haskell, you can write a data type that would be called a free applicative functor. It can be used to describe the shape of a computation. By reducing the surface area of said functor, by not exposing the "pure" operation, one can describe computation that are fixed in terms of their input.

This is amazing, because I mean truly fixed. The course of execution cannot be altered by the values of the input. Cache line eviction? All memory access is statically known in advance. Branch prediction? There are no branches.

The code would look a lot like what the Haxl[1] project at Facebook has produced. They used applicative functors to create a domain-specific language that described the shape of a computation without specifying the details. That allows them to write a compiler for their DSL in Haskell. In their case, they used Haxl to hide concurrency from their users, Facebook developers. Those developers can use Haxl to write concurrent, cached, optimized and type-checked queries against Facebook's datastores, without having to know how to write safe concurrent, fast queries. To the Facebook developers, there is no concurrency, the code they write just looks like a monad or an applicative in Haskell.

It should be no surprise then that one of the lead developers of Haxl originally worked on the Glasgow Haskell Compiler.

[1] Haxl slides [PDF warning]: https://github.com/meiersi/HaskellerZ/raw/master/meetups/201...
Hopefully this openssl issue has shown large organizations the need to have a way to quickly roll out security patches, ideally even before the vendor has released an updated package.

Imagine tomorrow that someone finds a remotely exploitable kernel issue, perhaps involving UDP packet handling. If you have the right infrastructure in place, you should be able to drop the patch file in the right directory and run a script that builds a new system package, runs some automated testing, and then pushes that package out immediately using whatever rolling update strategy is normally used, but at an accelerated pace.

I wish I had time to build something that makes patching system packages on debian systems simpler, making it trivial for businesses to "fork" the distribution as necessary to work around issues (whether they be security critical or not). I've written more thoughts on the matter on my blog: http://stevenjewel.com/2013/10/hacking-open-source/

If you're managing a smaller set of servers, I've been pretty happy with apticron and nullmailer as a way to make sure security updates are applied everywhere. It'd be nice if it could receive notification of security issues faster, perhaps via some sort of push mechanism, but it at least gets things taken care of within 24 hours.