skysight-inc/HackerNews huggingface dataset:
Oddly enough, I've had a lot of trouble getting my AppleTV to connect to iTunes services for the last 24h or so. I wonder if there might be some vulnerabilities being patched.
Well, that's a first. But good on them, I guess. Now if only they did the same with Rockstar.
Here's hoping "who's hiring"-type of recurring threads get popular, they bring a new sense of community and value to HN IMO.

They could all be organised on the same day, saving lots of time for those who don't want to be on HN too often!
In many places, the supply for cabs is artificially limited by the fact that there are only a limited number of licenses, which you then have to "rent out" from a licensee if you want to drive a cab.

The article raises a valid point (Uber sets itself up as a monopoly), but is very thin on criticizing the existing system.

In fact, nothing prevents existing cab dispatch companies from offering an app-based service like Uber does. That they don't is either due to the fact that the current regulations mean they don't have to adapt, or that it's Uber's business model rather than the app that makes the difference, in which case the app would just serve to sidestep regulations that only benefit well-connected incumbents.

The question here is how much you can separate the roles of

a) drivers
b) the dispatch service (telephone or app)
c) the entity policing both drivers and customers
d) the entity setting the prices
Since the 70's we had lots of safe programming languages with native compilers to choose from

Ada, Modula-2, Modula-3, Oberon, Oberon-2, Active Oberon, Component Pascal, Delphi, Turbo Pascal, Turbo Basic, Quick Pascal, D, Haskell, OCaml, Eiffel, Go, ...

C only got widespread into the industry as a side effect of UNIX's adoption.

Nowadays we pay the price for it.

Security conscious developers should only use C when there isn't any way around it.
This article only makes sense if Uber has monopoly power in the markets where it operates. If it is successful in its lobbying efforts, won't it be easier for Uber-like competitors to spring up?

I realise there are network effects in a two-sided marketplace, but how strong is the lock-in on the drivers' or passengers' side? Wouldn't either use multiple services and go with the one which offers the best price at the time?
right, that requirement to be tied to the employer is also what prevents the H1B to run its own company (although H1B can start a business, (s)he is not allowed to run it.)
> Where: At Microsoft Ventures, Unter den Linden 17

It's at the Microsoft product showrooms? I mean this is pretty much Microsoft's take on the Apple Store, I wonder how corporate/marketingy this 'retreat' will be.
I agree - I'm very lucky to be on the homepage but a monthly HMO post would be a great idea.
Looks like a fork that's gone through static analysis.
> What if you need to do something else and you don't know if there is a transform like function for it?

What about the same thing in python? As far as I know the two examples you gave exhausted list comprehensions' functionality.
If you're interested in this sort of thing, there is a great class at RPI which has its lecture slides available:

http://security.cs.rpi.edu/courses/hwre-spring2014/

The slides for lecture 4 (http://security.cs.rpi.edu/courses/hwre-spring2014/Lecture4_...) shows what various types of components (such as laser-trimmed resistors) look like on a die.
Thor's Hammer. http://en.wikipedia.org/wiki/Mj%C3%B6lnir
Exactly, I believe they were designed for instrumentation amplifier duty, hence the wide bandwidth and low noise.
That's a great analogy and highlights what might be a core issue for Twitter: what it wants to be (an social network with lots of two-sided interaction) vs. what its users perceive it to be (a newswire).
Yea. Because all locals are so highly educated. Have you seen CS departments at major school in the US? Look at the demographics and then think again.
Small startup soccer team goes on to win big
I thought the same thing at first, but then I realized the reason is because this was posted to the section "India Realtime" of the WSJ :)
It is a bit ridiculous that Iceland and China have the same caps.
Ha, yes indeed I wasn't quite expecting an international audience from HN to swing by when I wrote it! Local is indeed Brooklyn, NY.

Actually, a 3D fabricating shop that did custom framing is not at all a bad idea. It costs a lot of money to frame things well and if you can do custom dimensions using robots you might be on to a winner!
Yes, it was a drunken, stumbling step forward. Let's take another one, and move to something simpler, which solves the problem better.

To quote Phil Wadler's paper about XML, where he established some of the principles that influenced Xquery: "So the essence of XML is this: the problem it solves is not hard, and it does not solve the problem well."[1]

I suggest reading the entire paper; It shows a number of shortcomings, but it's also rather enlightening about how XML actually is structured, and how its semantics are defined. (ie, in spite of that quote, it's not just XML bashing)

[1]http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.109...
It depends. The GPL doesn't have an effect if your software is never distributed outside of your organisation e.g. if it's only ever used server-side.
Show HN: Tastebuds' iPhone App Connects People using their Music Libraries
Biohacking as the Next Opportunity
I have to take a break from playing guitar every day in order to make myself code. Different strokes.
True.. I wonder if any specs/certifications actually require something like that. Typically I mostly use tricks like that to track down bugs, but there's nothing wrong with using it in production for something like a single key/cert alloc. It becomes a bit unwieldy if you have lots of things to protect. (Especially on machines with 64k pages :))
Blatantly incorrect. Try thinking over how you might implement those two operations on a string with a length field and see if you can figure out why your statement is wrong.
Note that by visiting, your IP and referer become accessible by anyone running an heartbleed exploit:

93.142.x.x - - [11/Apr/2014:10:44:36 -0400] "GET /heartbleed HTTP/1.1" 200 1148 "https://news.ycombinator.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64)AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36"
Maybe they changed the description in the meantime, it now includes the newline, saying: "Proof I have your key\n"
The rise and fall of the Apple Newton MessagePad
I've actually been working on an app to help create these serendipitous situations for a month. Exactly the same concept, but perhaps developed further.

And for the record:

I can help with JavaScript things and with honing your ideas. And I need help with JavaScripty things and honing my ideas.

London-based if anybody wants to get in touch and discuss changing the world or just creating something awesome!
A few years ago I worked at a place where the CEO instituted this policy in the wake of reading about Zappos doing it. I remember him standing up at the weekly company meeting and offering a few thousand dollars to anyone who quit. The thing is, a week earlier, another coworker had put in his two weeks, and the look on his face upon hearing that announcement... I'm not sure if he ever got the money, but oh well. C'est la vie.
Generate passwords like Randall Munroe
Can someone explain the motivations of the major players here? The posted article references another Reuters article that goes into a little more detail: "Several large tech companies previously invested in IV, which gave them low-cost licenses to IV's vast patent portfolios as well as a portion of royalties IV collected." However, investments like this seem pretty short-sighted, and I would have thought that all players in the tech space would have woken up to the dangers of patent trolls years ago. What explains the continued behavior of Microsoft? Is this just another version of paying off the trolls to make them leave you alone?
I get all that, but to me it fits in line with my good vs evil being older than the written word thought. Most of what you wrote I can find in a history book.

bane's reply is more of what I was curious about.
Maybe you're right. My concern is that it'll just become completely un-navigable, whereas if it's something that people need to post proper posts about they're going to be more serious about it. But I see your point. Why don't we give it a go and see what happens?

Tom, this was your idea - you wanna do it?
It is the best RSS replacement. Let's me follow a lot of good sources, across multiple platforms. And not just sites, but individual, interesting people.

The DM feature? You can only message followers, kinda useless.
The Appeals Court acknowledged that there were lots of issues at play in the appeal, but that they only had to judge one of them to vacate the conviction.

The prosecutors selected New Jersey as the venue for the case, despite the fact that Aurnheimer and his co-conspirators hadn't been located in NJ, and AT&T's servers weren't in NJ. The rationale was that some of the addresses disclosed belonged to NJ residents.

Not only did they select a tenuous venue, but they allowed the court to sidestep the issue during jury instructions. The jury decides whether venue is correct. Because venue was important to the case, the jury was supposed to receive instructions on how to evaluate the validity of the venue. But the trial court decided that venue had been adequately established.

"The venue error in this case is not harmless
because there was no evidence that any of the essential
conduct elements occurred in New Jersey. If Auernheimer’s
jury had been properly instructed on venue, it could not have
returned a guilty verdict"

One reason this matters is that the CFAA charges that were applied to Auernheimer depended in part on NJ state law. In fact, the specifics of NJ state computer crime law might have been the reasons prosecutors stretched venue so much to get the case located there. But with the Appeals Court determining that the NJ venue was invalid, the whole framework of the case falls apart.
Fake resistors? How is one supposed to fake a resistor? There are no manufacturer markings on them, just (easily testable) resistance/precision indicators...
Java deep neural networks library with gpu support
so i assume any intermediate values from the RSA computations will end up in the heap and may be accessible by an attacker. is it possible to reconstruct the key from these values?

i could be missing something but it looks like signing does m mod p and m mod q and part of these operations involves doing a left shift on the divisor (p, q) and this is allocated to a temporary buffer. if these buffers are allocated near the heartbeat buffers then they could be leaked.

i'm looking at crypto/rsa/rsa_eay.c and it is possible that this code is not the code that is being used to do the signing in ssl.

/* signing */
static int RSA_eay_private_encrypt(int flen, const unsigned char *from,
unsigned char *to, RSA *rsa, int padding)
{

..
..

if ( (rsa->flags & RSA_FLAG_EXT_PKEY) ||
((rsa->p != NULL) &&
(rsa->q != NULL) &&
(rsa->dmp1 != NULL) &&
(rsa->dmq1 != NULL) &&
(rsa->iqmp != NULL)) )
{
if (!rsa->meth->rsa_mod_exp(ret, f, rsa, ctx)) goto err;

static int RSA_eay_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
{

..
..

/* compute I mod q */
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
{
c = &local_c;
BN_with_flags(c, I, BN_FLG_CONSTTIME);
if (!BN_mod(r1,c,rsa->q,ctx)) goto err;
}
else
{
if (!BN_mod(r1,I,rsa->q,ctx)) goto err;
}

..
..

/* compute I mod p */
if (!(rsa->flags & RSA_FLAG_NO_CONSTTIME))
{
c = &local_c;
BN_with_flags(c, I, BN_FLG_CONSTTIME);
if (!BN_mod(r1,c,rsa->p,ctx)) goto err;
}
else
{
if (!BN_mod(r1,I,rsa->p,ctx)) goto err;
}

#define BN_mod(rem,m,d,ctx) BN_div(NULL,(rem),(m),(d),(ctx))

int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
BN_CTX *ctx)

..
sdiv=BN_CTX_get(ctx);
..
if (!(BN_lshift(sdiv,divisor,norm_shift))) goto err;

BN_lshift() shifts a left by n bits and places the result in r (r=a*2^n).

EDIT: obviously if you leak p and q you can trivially reconstruct the private key :) but it is possible other intermediate values might be leaked as well that allow for key reconstruction.

though, considering left shifted p and q look a lot like normal p and q i'm surprised no-one has found this by just searching through the leaked data. so maybe this is not leaked or it requires a read at the correct time because these buffers might be trashed by another computation.
If the company is distributing profits rather than investing them in growth, then it is not a startup, it's a small business.

If the company is closely held, e.g. some sort of limited liability company or S-corp, then profits are often kept as small as possible unless otherwise dictated by an operating agreement among the stockholders.

For example, if revenue outpaces expenses by $120k, the stockholders can award themselves $100k in bonuses and the company's profit is $20k and you would see $2k at 10% instead of $12k [and there's nothing stopping the stockholders from awarding all $120k as bonuses in which case you would see nothing]. And that's just when they don't anticipate increased revenues. If they anticipate $120k greater revenue versus expenses next year the stockholders can give themselves $120k worth of raises.

If there's long term revenue streams, the stockholders can hire on family as consultants, enter the company into leasing agreements with companies that they own, and basically take anything that could be profit out of the company and it's all perfectly legal and common for closely held companies.

The reasons are that the tax situation of the stockholders of a closely held company is pretty much the same either way, but any assets of the company can be taken via lawsuit against it, while the personal assets of the owners are protected via limited liability.

None of this is to say that these things are necessarily running through the stockholder's minds. But not being a stockholder pretty much places any future revenue subject to the good will of the stockholders and it is not uncommon for people to make self interested choices when real money is involved.

BTW, being a minority stockholder doesn't really change much absent an operating agreement which governs the way in which profits, bonuses and salaries are determined and getting that is unlikely.

Good luck.
Still in-the-works, or do you want to share it with HN?

Perhaps we can help you hone this idea!
You have a funny way of making someone feel welcome, regurgitating memes and stereotypes propagated by Western media. Really, that last line in your post wasn't necessary.

Also, as the immigrant he will eventually be at the receiving end of at least some minor racism or xenophobia, no matter how progressive and open you think your society is. So lecturing him on that is kind of pointless as well.
Windows chief: Microsoft is all in with Nokia's Android phones
Live Machine Learning Talks from MLconf: Google, Yahoo, Netflix, Spotify...
I've been playing with 'Co', the thunk / flow control framework TJ uses for Koa:

#!/usr/bin/env node --harmony
var fs = require('fs'),
co = require('co'),
thunkify = require('thunkify'),
request = require('request'),
readFile = thunkify(fs.readFile);
get = thunkify(request.get);

var log = console.log.bind(console);

// Create a thunk, and run it immediately.
co(function *(){
try {
var fileContents = yield readFile('myfile', 'utf8');
log(fileContents);
var yahoo = (yield get('http://yahoo.com'))[0];
log(yahoo.statusCode)
} catch(error) {
log('Oh no, an error!')
log(error.code)
}
})()

Async, inline, catching errors. It's nice.
How Uber Creates an Algorithmic Monopoly to Extract Rents
Are you suggesting that a16z doesn't do this? Or that their firm is not doing well? It would seem to me that their limited track record is ... more than adequate.

Similarly, I would infer that your suggestion is ignorant that they have interest in the companies post-funding (as cnaut suggests "A lot of VCs firms are trying to apply more data to their investment decisions and that requires internal tools to handle it all"... which I think would suggest that they would want to examine the results of said decisions as well (which goes beyond simply the submission process)).
Samsung's War At Home
Employment based (EB) is the name of one of two major categories of permanent resident visas. It's a term of art that doesn't include H1Bs. Given that what you quoted included the term EB I thought that was rather clear.

As for one ethnicity dominating the country -- the entire permanent resident visa program subject to the 7% rule is only 366,000 visas per year or .1% of the population. Even if all of those visas went only to Indians and Chinese the US would be in no danger of being "dominated" by one (or rather two) ethnicities. In any event on the family based side, which has a larger allocation than the employment based, it is Filipinos and Mexicans who face the longest waits, not Indians and Chinese. Finally the mapping between ethnicities and countries of birth is not one to one.
No. There's no product showroom there, just a cafe on the ground floor. Hacker Retreat is happening in the space above, where MSV's incubated startups usually are. They agreed to let us use the space in between their startup rounds.
I'm assuming they're going to just let this die, now, and release weev, and not try again against him.

This avoids any serious ruling about CFAA, and preserves the arbitrarily-expansive reading of CFAA to use against other victims. They've already ruined weev's life sufficiently for their purposes.
Dragon Age: Inquisition in Kinect Voice Command Support Claims
Bloom.fm: Apple banned us from iAd because we're 'a threat'
I'm not sure how those two conclusions can be gleaned from this story.

It is pretty safe to assume that Steve Wozniak was not pulling the same types of shenanigans. And, it's really too bad if the story serves to normalize such behavior.

Second, it isn't a story about managers providing no value compared to less well paid engineers, it is a brilliant engineer letting something despicable pass because his partner brought so many non engineering assets to the table.

I think people should flee any company where there are dishonest managers who provide no value. It isn't uncommon to see companies that start out with comparable products, design and engineering talent diverge because one has a terrible management team.
> options don't tell you why they failed

Options aren't built into the language, they're just a standard library type that any user could define themselves, and we don't recommend them as a replacement for robust error handling anyway. For that we have the Result type, another type that's defined in the standard library, which does indeed contain an error message.

> you have to know what match does,
> what this magic (None) => business is...

`match` is just a beefed-up switch statement. And `None` is, to reiterate, an essential component of the standard library, and not magical in any way.

Your Rust code also shows that you've never actually used it before. Here's a proper translation of the Go code into Rust:

let result = foo();
if result.is_err() {
return result;
}
This should be the major argument against GnuTSL and OpenSSL. PolarSSL is symbolically verified!

You can see some screenshots at http://blog.frama-c.com/
but unfortunately their frama-c annotations for polarssl are not open source. It would help a lot if such annotations could be used for similar crypto APIs also.

There are many more such symbolic verifiers and bugfinders out there (using solvers), but Frama-C was one the first and is still one of the best.
My current strategy is described below. I have been using it for about a year. It provides strong, unique, secure passwords with no memorization:

I use passwordchart.com (I am planning to create my own improved version at some point). It requires a generator phrase to create a "password chart", which is simply a mapping from each alphanumeric character to a different 1-3 character alphanumeric string. You then type in an easy to remember password, and it maps that to a far more secure password using the generated chart. I use the same chart (with a backup printed in my wallet), and apply the same methodology for every service I use to create my easy-to-remember password. I read the "how it works" page and it seems pretty secure to me. For all my password needs I only have to remember two things: the generator phrase and the method for making the easy to remember password. There is also little counter party risk (passwordchart.com doesn't know where the passwords are used, it would be hard to change the chart without me noticing, and I have a backup). I love not having to think hard when signing up for something new. In 5 seconds, I have an easy to fetch, secure, unique password for any service. The only real concern is over the shoulder snooping, but I just ask people not too look.
Er...CTO of Tinfoil here. We respect the Detectify guys a lot. Not sure what you were trying to get at, but there's no conspiracy here. We don't engage in subversive competitive tactics.
How did you start the process?
Not so; companies like RHEL understand the importance of disclosure timelines and won't leak it early.

The importance of telling large distros doesn't lie in them immediately releasing a fix; it lies in them being able to prepare a package with the fix before the announcement, and then exactly when the announcement happens, they can publish the package (and possibly do something to make it propagate faster to their distribution servers)

As is, when Heartbleed was announced, many distros took an hour or significantly more to offer a fixed package. Proof-of-concept exploits were also made in that time. That was a dangerous situation.

I fully expect critical vulnerabilities that are "responsibly disclosed" to be reported to major distros so that packages can be prepared, but not released, in advance; furthermore, it allows people to be ready when it's announced at an agreed-upon date so that the packages can be pushed to live.

I'd actually be okay with a system where smaller distros which use similar packaging formats to larger ones are alerted with "There is an exploit. We will publish a fixed package that will likely be compatible with your distro on DATE. Be awake then to make sure these changes go live quickly, not when one key dude wakes up in 5 hours".

Sorry for the long-winded comment. What I really wanted to do is just explain "no way to share ... deploy a fix ... without making it public" is not the reason for sharing. The reason for sharing is so that the fix can be deployed more quickly when it is deployed.
Anyone know how these guys compare to Freshdesk ?
As a sort of side note, why is it

filter p (x :: xs) with (filter p xs)
| (_ ** xs') = if p x then (_ ** x :: xs') else (_ ** xs')

rather than

filter p (x :: xs) = if p x then (_ ** x :: snd (filter p xs)) else (_ ** snd (filter p xs))

?
Thing is, its not even ethnicity that decides the cap. Its 'place of birth'. If you are an Indian citizen, born in the UK, you get to skip the Indian line.

Still, I see no basis for discrimination based on place of birth, ethnicity, race, caste, creed, color etc. when I can do my job right and be good at it. I would agree that if it were a lottery or family based immigration, such caps could prevent chain immigration. However, employment based visas having that cap makes absolutely no sense and blatantly discriminates.