skysight-inc/HackerNews huggingface dataset:
It's like those commenting "that skyscraper is garbage" by someone who doesn't even know what you'd need to build a skyscraper, let alone actually tried to build one.

It's nothing like that at all. A piece of code's popularity is no evidence of its quality. Otherwise we'd never have advanced beyond BASIC.

Implementing an entire spec is nothing to be proud of. Specs are often over-engineered. This is almost certainly the case for TLS. It's 103 pages long: http://tools.ietf.org/html/rfc5246

We should be questioning the foundations we've been relying on until now when a single vulnerability was able to compromise most of the internet, possibly since 2011.
Well said. More generally, it is often difficult to disentangle someone's motives & beliefs (and therefore the things they say) from their occupation. After all, the more deeply you believe in something, the more likely it is you will try to make it happen, the limit of which is making it your primary career.

Suppose someone working at a travel website writes a post about the problems with the existing travel industry. A large percentage of commenters will then pipe in with, "of course she'd say that, she works at a rival firm!"

But is that the causation? Suppose an "independent" person writes the same blog post. The reactions to the blogpost would have been different in that case, even if that person later goes on to start a travel firm.

In other words, is the causation:

1. start/work at travel firm -> try to encourage people to switch to them -> write blog post

2. dissatisfaction with travel firms -> write blog post -> decide to start competitor

(And of course there are many other possible causation chains.)

Yet most commenters seem to assume that (1) is not only the most likely option, but often the only possible explanation.
http://www.phoronix.com/scan.php?page=news_item&px=MTY1Mjc
just tumblr blog, not real-time status page like statuspage.io
the Wall Street Journal has been reduced to reprinting tweets as news

Why 2024? I've already seen this happening for the last few years, where the established press takes original content/reporting/etc. from online sources (blogs/etc.) with scant attribution.
> The code is some of the most efficient and widely used.

Efficient, yes. Throughput in general is not a problem.

Widely used, well... yes to that too. Although in this regard I would attributed a good chunk of it to inertia. When (common) use of cryptography started to take off around the time of the browser wars, there weren't too many options around. Web servers needed a way to serve protected content, and there was OpenSSL.

Not just available, but already supported by language bindings and relatively easy to set up thanks to mod_ssl.

First mover advantage + network effects + the fact that getting crypto right is really hard. If you wanted to unseat OpenSSL, you would need to overcome the fact that despite all the bad rap and the butt-ugly, and the leaky API, it was still getting the most exposure and field testing. Unlike some newcomer library, OpenSSL has the advantage that it is firmly embedded in the software ecosystem, and it has benefited from more than a decade of bugfixes. (I still remember when the timing attack for extracting RSA keys was discovered. The bug was pretty much everywhere, and not just in OpenSSL.)

The widespread use of the library boils down to a simple and womewhat depressing fact: OpenSSL is used everywhere because OpenSSL is used everywhere.

Replacing it with something better will be a long uphill battle. Any newcomer would need an aggressive test suite which covered EVERY known implementation bug. And a sane API. And a project with the political savvy to succesfully lobby for its use through all avenues.
I had a couple problems requiring a btrfsck, specifically related to google-chrome cache directories. Never had it since. I use btrfs snapshotting a lot (for convenient system rollback).

I definitely am not running btrfs on a production machine, but I love it on this laptop. Wouldn't call it stable yet.

edit to note that I don't hibernate, just sleep.
Because of Him
> I'm sure that in situations where they're confident they're the only ones with the knowledge, they'll still hold off on releasing anything.

How can they be sure? They simply can't. And this means they're putting US business at risk for their own benefit.

(The other way to put US business at risk is via worldwide reputation damage.)

I doubt this makes US companies more interesting for investors.
If OpenSSL had been GPL licenced, this would have been public a long time ago.
I'd go for a shorter version, but: yes, you are right on. Important points:

1. Have legal counsel

2. Deal with the issue now, not later.

I'd get a lawyer and fire the CTO. Small teams require absolute trust, and that is now breached. You'll find out in the process how the CEO aligns. Give your partner a heads up, but don't let yourself be moved from the task of firing the CTO.
I think most Americans (such as myself) are grossed out by the idea of a bidet.
Actually as long as they don't distribute the code, even under GPL they don't have to share it.
Keep the web, give them food
And Akamai would probably not be using OpenSSL if it were GPL (maybe because of a business decision within Akamai, or just because OpenSSL would never have become so popular).
This is a great example of why a little knowledge is a bad thing. It almost sounds like you know what you are talking about, which probably confuses people.

Heartbleed is dangerous because it exposes private keys, and that let's you decrypt SSL traffic. That in turn may let you read passwords.

Don't conflate the two separate things.

Compartmentizing is good, but doesn't protect against Heartbleed.

Disposable proxies don't protect you.

Perfect Forward Secrecy does protect you because the private keys aren't reused. It is notable that you didn't mention the one technique that actually helps.

To me that shows you misunderstand what heartbleed is. Some if your critisms of OpenSSL are valid, but not for the reasons you claim.
As others have mentioned, we've seen reports of network and power outage, and now I've received a notice of hardware failure.

Just when I set up HA load-balancing, the whole data center outage takes it all down for 4 hours and counting.

Hello,

The host that your Linode resides on experienced hardware
failure. As a result, drives are being transplanted to
separate, known-working standby hardware which we keep
available in case of events such as this.

Again, we're very sorry for any inconvenience caused by
this issue. Please feel free to update this ticket in the
event that you have any additional questions or concerns.
Interesting, I like the "git status -sb" (short, show branch tracking info) command. The query one seems a lot like "git grep" to me, I am not sure I understand the difference.

The specified "git ac" alias (git add . && git commit) is bad news, in my book. I've seen people accidentally commit extra files using "git add ." .

I much prefer "git add -p" for tracked files; the git tab completion for the shell seems to be pretty good about picking up untracked files using "git add <TAB>" as well. (https://github.com/git/git/tree/master/contrib/completion)
I particularly "love" [1] articles where they take screenshots of a bunch of tweets, and present them with interspersed commentary, rather than actually writing a coherent narrative. Guess it makes it easier to recruit "journalists" when you don't need to worry about whether most of them finished high-school.

[1] for certain values of "love"
> a handheld sprayer next to them -- part bidet and part firehose

"Bumgun"
If the government was aware of Heartbleed,you can be sure that knowledge was buried deep in the NSA, not at your local FBI office. It is laughable to think the FBI knew about this.
I find it difficult to come up with the right validation criteria. Would you share your thought process? How did you come up with specific numbers?

Of a sampling set of people searching for Charades online, at least 25% will sign up
to check out the game.
I think they (businesses) often pick OpenSSL exactly because it's not GPL licensed so it's kind of chicken and egg
You mean the application? They need to distribute the code if they provide applications based on the code.
Does Linode automatically check for, detect and replace faulty hardware? Or is this something you have to explicitly ask them to carry out?
Yup. It's pretty common for open source to be used, abused, modified in house and not shared. Just look at Sergey Aleynikov and Goldman Sachs. [0] Further I've seen a shop deploy hundreds of thousands of CentOS nodes to avoid RHEL license fees. Doesn't even begin to scratch the surface of shops not funding FOSS they exploit like OpenSSH, etc. Most of them are stingy, demanding, greedy bastards.

[0] http://blog.garrytan.com/goldman-sachs-sent-a-brilliant-comp...
Normally they just detect it and raise a ticket like this (which happened here).
Hey, I found the CTO ;-)
Sort of. But Google has a history of how it treats independent researchers.
Maybe he is telling you the truth, but you are a founder, he is a CTO. Maybe it is just a simple case if you are currently contributing code to the idea to step back and let this other guy handle the coding aspect for you. Maybe you can better spend your time as a co-founder elsewhere in your company.

Having said that, if he is forcefully advising you to leave, he is overstepping his boundaries and you need to contain that fire now before he starts turning other employees against you. A toxic employee in a company is like a cancer, it will start in one area and if not treated, it will spread throughout every orifice in your body until it kills you.

If it is a simple matter of you're making it hard for the CTO to do his job because you're committing code and continually breaking things, maybe you need to step back and let him do his job. He can't force you out of your own company, but he might have enough collateral (if he is truly instrumental in your company's success) to get other people to listen to him and force them to make a decision. The CTO is either brutally honest, he's an asshole or he's gunning for your spot in the company.

I would be looking at this from all angles. Don't just assume the CTO is acting alone, for all you know the CEO or your business part is instrumental in his push for you to leave. You're not just an employee, you're a co-founder and you have rights and responsibilities. You're acting like the CTO has already one which will be your downfall. Exercise your rights as a co-founder to fix this.

I would seriously fire the CTO. He might have been instrumental in the companies success, but he has overstepped the line. He has gone beyond the point of merely telling someone they're making his job hard, he's asking a co-founder to leave. It's like some manager at Microsoft asking the CEO to step-down, it's just crazy.

Get legal advice ASAP. Explore your options, but without-a-doubt, get legal counsel right away before you do anything else. My first question to your lawyer would be: Can I fire the CTO cleanly without recourse?
Looking for Tom Lehrer
Support for the CPU code names in -march is a simple but really useful change:

-march=nehalem, westmere, sandybridge, ivybridge, haswell,
bonnell, broadwell, silvermont

Also this:

-mtune=intel can now be used to generate code running well
on the most current Intel processors, which are Haswell
and Silvermont for GCC 4.9.
I think that this is a good sign. I know everyone has been saying that OpenSSL code is terrible (can't say I have looked myself), but if this is the worst bug found since heartbleed then maybe it is better than it appears.
http://imgur.com/AM11LCz

Working on my website for my wedding. Using it as an opportunity to teach myself Django, so that I can make mistakes here before I start using it for a work project. Right now, I'm working on adding the ability to RSVP for events.

It's been really great to learn how to use Docker, Redis, Postgres, etc. to make this come together. Overkill likely, but still fun. :-)
I'm actually a big fan of the 24px type. Pretty sure that the page was designed for large resolutions.
For what reason would the OP need to negotiate with the CTO?
You'd make a better CTO than him. I'd rather work for a CTO who listens to good advice than one who is really sharp, but fucks people over.

Obviously, you are fairly technically competent (or he wouldn't need you around, and you wouldn't have gotten the prototype working). You're also a competent leader - you are listening to technical advice.

But let's say you hire a few more good coders. The CTO feels threatened. Is he going to listen to them when they challenge him, and possibly even step aside if one of them would be a better CTO, or is he going to fuck them over the same way he's fucking you over?

He sounds like a toxic political player. You can think "He's a snake, but he's our snake. His political skills will give us an edge", but it rarely works that way.

If you can, get rid of him, promote yourself to COO, and make the other good programmer CTO or lead programmer or something.
What would be really cool is if you showed what they would look like with the name on them as you typed it.
A COLOUR ANALYSIS OF THE APPLE APP STORE
Ruby author 'Matz' does television ad for his Mormon faith
Dead wrong. When lives and money are on the line, there is obligation somewhere along the line back to the source. Maybe it stops elsewhere, maybe it doesn't. If folks are depending on open source for life-safety or risk the safety of innocent or targeted individuals, there is an obligation at some point to ensure systems are as secure as humanly possible. More importantly, regardless of circumstances, there is a fundamental duty of engineering ethics. [0] They're not just cliche words or some worthless university course, but the implications of how design decisions and construction of something affects the real world. That crappy commit to [project here] might be the difference between someone living and someone dying.

[0] https://en.wikipedia.org/wiki/Engineering_ethics
"What is perhaps more interesting is the things that are worse."

First and foremost I believe is resistance to change. The reasoning of "because that's the way it has always been" and general bureaucracy means change is very slow to come. When change is actually put into motion it occurs with amazing efficiency but initial resistance seems much stronger than many other cultures.

Anyway, my personal counter list might go like this:

- Blatant sexism

- The work emphasis placed on quantity (time) over quality

- Despite a reputation of High Tech, requiring paper (printed) documents for nearly everything.

- Meeting people outside of work/school is so unusual that often you can make someones night by striking up a conversation in a bar. Great for the visiting tourist but seems suffocating for many Japanese.

- Fantastic food often ruined by the people chain smoking right next to you.

Still really enjoy living here, but I fortunately don't have to deal with the Japanese work environment like many of my friends do.
> There are two possibilities right off the bat: (i) the CEO is involved, which is likely given the difficulty involved in squeezing-out a shareholder + 50% co-founder; (ii) the CTO is working alone, hoping to push you out the door and benefit in some way from the resulting vacuum.

Well aren't you mister negative here. If this guy was just an employee the tone of this thread would be very different. Every CTO knows there's coders that can just drag down the efficiency of the team. Every programmer knows in his bones that some programmers are poisonous to your codebase, even if they get shit done.

So how about a third option: They are just trying to cut out dead weight from the company.

So yes, get an attorney, yes, make sure you get what you deserve. But don't assume your friend (your cofounder is your friend right?) is backstabbing you before you are absolutely certain, no use in getting bitter before the hurt is done. A startup is a business, and businesses need to run efficient to succeed.

Asking you to leave, and asking it to be in three to six months, that's quite different than doing it suddenly when your grandmother dies. To me it sounds like they're doing it as classy as they can.

I'd say, if you really want to keep working with them, step up your game, make sure you're the programmer they need.

In any case, lawyer up, you have risked a lot going into a startup, so you most definitely have rights to that slice of the money pie when it comes.
I always thought that it would be good to have an agreement with my cofounders that if ever a compromise cannot be reached, a "roll of the dice" will be used to decide the question in contention. (By "roll of the dice", I mean the probability that the course of action favored by investor A prevails is proportional to the amount of stock held by that investor.)

But I've never seen any references to a startup that actually uses such an arrangement. (What I have seen a lot is the notion or principle that the investor or coalition of investors with at least 50% of the outstanding stock decides, which does not seem to me to protect the interests of minority shareholders as well.)

Do any lawyers want to offer a guess as to whether a contract between cofounders (or between cofounders and investors) with such a "roll-the-dice" clause in it would be enforceable in the California courts?

P.S. Also, am I completely crazy or are most of the comment authors here wrong in implying that whether the OP will prevail in court has anything significant to do with how good a programmer he is?
For coding/documenting/analysis, under Windows, foobar2k , playing whole albums from my collection brought to work on a 2.5" USB drive. DT770 headphones.

In the lab, I often have electronic music mixes on loudspeakers, it's more monotonous and fits to the bunker atmosphere where I work ;-)
Weirdly, I had this exact same idea a little while ago and threw something together: http://polygonz.zaucetech.com/ its open source too!
PHP5 is widely used. The security history of that is less than awesome.

I think OpenSSL is better than I could do or most people could do, but again, it's still at the mercy of C AND a wide range of TLS and other features that seem to multiply like rabbits.

I think we really need a much, much simpler TLS standard going forward.
> Adding `#L52` to the end of a code file URL will highlight that line number.

You can click the line number (in the column to the left of the code) to add the fragment to the URL, and Shift+click to select a range. Easier than editing the URL directly.
I guess this is a popular idea, made this one a little while aog: http://polygonz.zaucetech.com/ its pure javascript and canvas and allows any color you want
Well yes you wouldn't want a lasting relationship with that guy, but I only really need him for one evening so I don't show up to the dance without a date. Because then I'd just look silly.
>Most of them are stingy, demanding, greedy bastards.

I'd go so far as to say "nearly all of them."
This isn't a bug found in a thorough audit of the entire OpenSSL code base. This is a bug that was discovered while trying to understand why applications using OpenSSL would run into trouble after disabling the code that made it impossible to detect Heartbleed with OpenBSD's malloc safety features.
> The query one seems a lot like "git grep" to me, I am not sure I understand the difference.

1. shows only the most recent matching commit

2. git grep is essentially `grep` customised to the working copy (by default), you probably mean git log --grep

3. `:/foo` is actually a general revisions specifier, see third from bottom in section SPECIFYING REVISIONS of gitrevisions(7), so you should be able to use it anywhere you need to specify a revision (not that I can see much use for it outside of log and show at the moment)
http://skylerlipthay.com/images/honeycast_screenshot.png

It's an OS X application called Honeycast for composing audio/video layers and broadcasting (much like XSplit for Windows). The screenshot shows a session with a couple screen region snapshots and a webcam's video being composited.

I have been working on buttery smooth 60FPS screen capture (really tricky on these retina Macbooks with underpowered GPUs). It's looking great.

Now, I'm working on the RTMP protocol to communicate with video streaming servers (Twitch.tv, Justin.tv, YouTube, etc.).

I'm hoping to release to the App Store soon. The closest solution like Honeycast on Mac is the $500 Wirecast. I think there are a group of people that could benefit from a cheaper solution!
This is sweet, maybe you could benefit from some of the code I wrote a little while earlier for something super similar: http://polygonz.zaucetech.com/
Mine was rebooted 2hrs ago but still cant access it.
I'm building a cool xkcd web client:

prototype: https://api.monosnap.com/image/download?id=hZZrJ4zp5DyOR5HNo...

It will allow users to:
- See which ones the have read (kind of like email)
- Favourite comics
- Discuss them in comment thread
- Search through the comics (using title, number, alt-text and transcript)
- Set up notification schedules, e.g. "Put a random comic in IRC at 2 o'clock every weekday" or "Email me the latest comic when it comes out"

I will hopefully be launching it within the next few months... :)
This is true, but inferences from silence are much more problematic when you haven't said anything. If I tell the police a story about what I had been up to that afternoon, and then they say "right so if that's true, why was the victim's blood on your shoes?", and I choose at that point not to answer, it's suspicious, and can be played as such in court.

If, on the other hand, I have said nothing other than "I'm not speaking without discussing with my lawyer first", it's much easier for your legal counsel to paint you as just a cautious individual, rather than someone that is trying to cover up a lie.

tldr, "don't talk to the police" is also good advice in Commonwealth countries, not just the US.
Cool, I've always wanted to do something like this. I love my IRC & BNC set-up and have always thought that other chat systems could learn a lot from it, and at the same time that the process could be simplified for newer users.
I searched for your site and found lots of pages about vibrators - not sure if that's a good or bad thing.
Evidently DC issues are fixed, since some of my servers are up again. Others still down due to (related?) hardware issue. Linode support proactively opened tickets about those that are still down, and upon friendly questioning, expressed a high level of confidence that they'll be back up once drives are migrated to stand-by hardware.
This seems to be a similar approach to the one taken by Windows[0]

There were a causes for the poor resume time, but a large contributor was device resume time. Since the OS serialized S0 IRPs to all devices in the PnP tree, the time for each device to resume added sequentially to the system's resume time.

The OS serialization of the S0 IRPs could not change for Windows XP, so the problem was attacked at the other end...each driver would complete the S0 IRP as fast as it could so the OS could resume quickly and then asynchronously power up the device.

This way each device could power up in parallel and the total time to power up was not sequential (nor was it only the longest of any device to power up since there is still ordering between parent and child devices) and resume time could be dramatically slower.

[0]http://blogs.msdn.com/b/doronh/archive/2007/10/15/fast-resum...
+1 on all pointers. That's what his co-founder is supposed to say. Unfortunately, failing to support each-other in such ugly cases, says much about the future (or the lack of one) of this partnership. :(