skysight-inc/HackerNews huggingface dataset:
Instead of exposing students to Windows kernel code[1], it would be better to consider to read the ReactOS source code - an open source clean room re-implementation:

http://www.reactos.org

[1] signing such an NDA will prevent them from contributing to various open source projects, that would be a shame.
libsodium, which is a cross-platform version of Dan Berstein's NaCl.
Best DVD Ripper to Backup Kids Easter Movies, Rip Animated Easter Films DVDs
The best DVD ripper to backup kids Easter animation movies 2014 – WinX DVD Ripper Platinum (or for Mac) rips DVDs of best Easter eggs movies, hop movie, Break movies, Easter Parade movies, Easter Bunny pictures, etc on PC and Mac.
Then we should just all agree to treat certificates issued before 08/04/2014 to be invalid for everyone.
It will be a day or two of complete mess but given the scale of the exploit it is not crazy to consider every single certificate used before this date to be insecure.
And this way we don't rely on broken revocation mechanism. And it will force sys admins to follow good practice (for instance, the public lab I work for still have not fixed the heartbleed bug on our central auth server and they are not yet convinced it is necessary to regenerate the certificates...).
I don't have a family yet but I'm planning on doing something similar. You are allowed to retire at the age of 67 in Germany (well at least for my age group - I'm 29), so I calculated how much money I would need to live in my home town which is in Turkey. Depending on how much I can save now, I would be able to retire earlier.
However I still need to come up with a good idea on what to do there because I cannot imagine doing nothing 24/7. Usually I get bored after the first half of a two weeks vacation. As for work life balance, I count myself lucky to have 30 days of paid vacation at my current job.
I would be very happy to read anything you write about your experience, and promote it widely. Would you share your story, here or anywhere else?
One mildly interesting / infuriating pre-Snowden tidbit: the UK was having a national discussion about this kind of mass surveilance. GCHQ were asked for their response a few times. They replied saying things like "it's useful for some crime prevention; you need checks and balances" and so on. What they did 't say was "this isn't relevant to us, because the law already allows us to do it (also, we already are doing it)".

With hindsight I can see how carefully they crafted all their answers. It is very frustrating to me that journalists did not read the relevant laws (which clearly list exemptions for GCHQ) and did not question the relevant oversight bodies or GCHQ for more information.

I tend to agree that slurping and storing all content data or all metadata is probably the wrong approach.

It does make me wonder if the technology got released in any form, even as university research, back to the public. I can understand keeping bomb design documets secret, but better database and better data mining tech is less sensitive.
We need to stop have such a fucking accepting attitude about sloppy engineering in security-critical code. People who don't want to be held to a high standard should get out of there and go do something that can't break the internet.
Great! I'd love to read something on http://ceylon-lang.org or http://kotlin.jetbrains.org
"nobody" is not an absolute here. It's a reminder that the vast majority of people who get the idea to write their own memory allocator, garbage collection or filesystem will do an even worse job at it than the people who implemented the ones we typically use did, but it will end up going mostly unnoticed and possibly make it into some critical piece of software.
It was among the first at the time. OpenSSL was probably the dopest shit on the interwebz of crypto (or came close to it) at the time. Furthermore, these days it's too widely used so, everyone is just "fuck it." OpenSSL is the PHP of the cryptography world.

Also, I've see a ton of code just invoke the OpenSSL tool instead of actually use OpenSSL library.

I tried to use the library and was down in spirit, much like the author of the blog post, but I was too disappointed to even care, and just gave in to calling the tool from my code.

An idea: create a fork, call it OpenSSL2 and clean it up, but maintain both codebases, and end support for OpenSSL1 in 2-5 years?
Possibly the first two, but I don't think ignorant. I would not wish on anyone what happens to transsexuals in prison.
I remember all three, my father used to leave me at the console when he would take me to work on the weekends at IBM. Not sure that was system 3 or not.

Between that and reams of green bar to use at home for "artwork" I found my fascination with computers. Didn't hurt we had first generation IBM PCs and before then my father had about everything heath kit put out.
Zijn er dan goede en slechte koolhydraten? | Ik eet suikervrijIk eet suikervrij
China creates their own version of codecademy
We’re open sourcing our Code Review tool for GitHub
There is a difference between infiltrating companies and deliberately introducing a bug that compromises a large chunk of the Internet. I would assume the NSA is interested in gaining access to systems in a way that doesn't allow basically anyone to ride on their coattails.
Doesn't Haskell compile first to C and then to native?
I don't understand this attitude, if something is incredibly complex and very hard to get right, this can indicate that there is a mismatch between the tools you use to implement it and what you should use.
With the right language it might be much more pleasant to implement:
Consider for example https://github.com/GaloisInc/halfs a filesystem implemented in Haskell, I think it has ~10000loc

It can also mean that existing implementations are poorly documented and research papers on the subject place no importance on implementation details.
Of course you should not use your first implementation in production, but that is as obvious as not letting someone do brain surgery who has no prior training in it.
I take it you didn't press check then? ;-)
I know I'm replying to a troll, but... you have been following the news, right? Would you rather have us use the backdoored RSA bSAFE library? That was developed by paid professionals, who by your logic should be the paragons of competence.

All software has bugs.
Good luck! Congrats on the launch.

A couple of things:

- I couldn't find anything on pricing. Why hide it? I couldn't find it anywhere.

- The red button with the lock at the top - is that really the right color choice and icon for a "get started" link? Red often indicates error in web UI and a lock often indicates "You do not have access".

- The blog - when the first entry on the page is "How to find a startup investor", my interest as a cloud customer wanes. Either make it by category, or spend some time on the UI of the blog so that "people who click through from the cloud360 website" are shown blog entries related to cloud computing/hosting/admin/etc.

Hope this helps in some way.
Charging any amount of money adds friction. $0 to $5 is a bigger jump than $5 to $50. All I care about is having SSL everywhere.

Maybe someone like CloudFlare could cover the "Free CA" project.
Decentralized orchestration tool Antitude announced PipelineConf 2014 in London
Inactivity and not working is not the same. You can be pretty busy with personal or charitable projects whilst not working.

So skills-wise it is not a problem if you keep tinkering and learning new stuff, although not if you just take a 6 month holiday.

You might have a harder time explaining the gap in your CV/Resume, especially to more blinkered enterprise companies but that is another issue.
A bit of an aside: Are there any methods for compressing/collapsing/simplifying a neural network.

What I mean is imagine you've built and trained a neural network, as per the article, it is hard to ascertain exactly what it is doing. I was wondering whether there is work in this area, and it occurred to me a possible first step would be to collapse the neural network to a simpler but functionally equivalent structure.

I imagine this is far more difficult than it sounds, but I just wondered.
> I suspect the author just doesn't know about ag

Actually, the author uses Windows, and ag is a pain to build on Windows. pt[1] (written in go) has drop-in builds for Windows, Mac, and Linux.

[1] https://github.com/monochromegane/the_platinum_searcher
Write it in safe, modern C++, with an extern C API.

I'm sure that leaves out a few rare cases on embedded platforms where they only have a C compiler, but they could continue using existing libraries.
The idea is to leave each component to the experts. If you're a concurrency/memory expert, then write a malloc library. If you're a cryptography expert, write your crypto code and use someone else's malloc.
I think the Bitbucket piece is smaller than Github. But Atlassian also have a whole bunch of enterprise-oriented products, more in the same kind of market as Thoughtworks or one of the big enterprisey lots.
No pricing,
No information about privacy,
No information about if this entirely online or you have to install something
No real documentation before being registered

All of this => I won't register
when accessing this site through Firefox I get "Peer's Certificate has been revoked." Chrome works fine though.
Nice. But how do I decide which to start reading and in which order to continue?
> I think everyone should write their own GC, write a filesystem, and handle their own memory layer, at least once.

Of course. But not in production. Which is a detail missed by the snarky one-liner, maybe because one-liners suck. Still, the point isn't that people shouldn't ever write them, just that they shouldn't actually use the ones they developed while not being a part of a team of experts specializing in the issue at hand.
On the other hand, if the NSA pwned OpenSSL, shouldn't such a big thing have been in Snowden's docs?
It is surprising that a project that is quite mission critical is completely at the bottom of the scale when it comes to how much the development process is oriented toward reliability. There are no systematic unit tests, no systematic documentation, the best you get is a bunch of disorganized integration tests, so it is not even at the level you would expect for a decently maintained business project: https://github.com/openssl/openssl

Perhaps the open source model of development is just not very good for software of this kind. Of course it's good that the source is open for everyone to look and potentially contribute, but without funding and without having a real process and a full time team it seems to me it is hard to get the level of quality required.

I also wonder how much in the end the big institutions care about this stuff. Intel hires a bunch of guys to do formal models of their processors to ensure bugs aren't shipped to millions of customers, why is nobody funding a formally specified version of SSL? For other mission critical systems, like what goes into spacecrafts, or hospitals, or gets developed in the military there are rigorous processes in use to prevent stupid mistakes, so it's somewhat disappointing that the major infrastructure pieces don't receive this kind of treatment.
Bugzilla is much easier to use than Jira; it does what it needs to (tracks bugs) and gets out of your way, rather than having eleventy different modes and dialog boxes and view rules to confuse you when you just want to resolve bug x.
I guess we should just let you code it in Enterprise java and pay you dividends.. Get a hold of yourself - most open source is actually funded by large companies in the first place. And being drunk has nothing to do with bad code, I for one code better when inebriated. Your straw man banter doesn't need to be on HN.
0/10 Try harder next time
If the certificate has been revoked (as it should be if it is older than a day), it is actually Firefox that is working fine in this context. Probably heartbleed fallout.
> This is an artifact of BASIC. It doesn’t really have an effect in C#. In BASIC, just as in C#, the randomizer could have been initialized based off the system time. If that was not an option, they should have taken advantage of the instructions prompt.

User inputted seeds were in a lot of classic text based, randomly generated games - by sharing the seed with friends, you could play through exactly the same game and see who did it better. Multiplayer!
This technology is turning jellyfish into toilet paper
The NSA, according to the Snowden docs, can break SSL. No details though: http://blog.cryptographyengineering.com/2013/12/how-does-nsa...
To get the effect I was referring to, yes it is too strict a class. I wasn't thinking very hard about it, but my idea was that conformal transformation have nice compositional properties, which could be exploited in developing the method and its analysis.
Lexik provides Symfony2 trainings in France with PhpStorm, includes free license
This made me think of clang/gcc's vector extensions [1], which, together with __builtin_shuffle can be used to get some real "ok" cross-platform (SSE/NEON/...) SIMD code going on. An example of this in usage is [2].

That said you're right, usually the best performance can only be obtained by using really specific instructions. But in my experience, a decent performance increase can be obtained by using the generic vector extensions.

Moreover, if you can use the vector extensions for a large part of the code, that means you have to write a lot less platform-specific stuff. I.e.: you increase portability anyway, since now you only have to rewrite 5 out of 20 functions instead of 20/20. Even better, they allow one to write v3 = v1 + v2 instead of v3 = _mm_add_ps(v1,v2). The first one being clearer, more portable (will generate appropriate addps or equivalent NEON, ...) and plain nicer to read.

Your pcmpeqd example is a good example of an optimizer flaw. In my opinion this is orthogonal to whether or not to expose a specific or generic API. The compiler should've use the most efficient instruction for that simple idiom, period (without you telling it to use pcmpeqd). If we continue your line of reasoning, we're back to assembly for everything.

[1]: https://vec.io/posts/gcc-and-clang-vector-extensions (The vector extensions allow +,-,*,/,<,>,==,!= to be naturally used for SIMD types)
[2]: https://github.com/rikusalminen/threedee-simd
Today a dinosaur icon tomorrow a Stalin icon, we must draw the line!
"But how did it ever get so widely adopted, if it's so hard to use?"

Usefulness and lack of alternatives?
Because they say "don't roll your own crypto" so nobody does it anymore. There is some truth in it but it's getting to sound like nobody should touch crypto.
F#, Mono, Agile, Architecture, and DevOps
This bug was added 2 years ago, the Snowden documents are from before that, as far as I know.
Writing a memory allocator is a great project. Too many programmers believe that malloc() does 'magic' or that what it is doing is simple.

After writing your own allocator, you'll never view malloc() as a cheap and simple operation again!
Kleinanzeigen
Kleinanzeigen Deutschland , Kostenlose Kleinanzeigen , Kleinanzeigen , Kleinanzeigen Berlin
Mall Deutschland Kleinanzeigen , Kaufen, Verkaufen, Immobilien, Autos, Jobs
Mall Deutschland Kleinanzeigen , Kaufen, Verkaufen, Immobilien, Autos, Jobs
The article laments a disconnect between learning and work force skills. On the other hand, they claim a high school diploma makes $260k difference in life time earnings.

So what value does a high school diploma provide? What's the reason for the $260k increase?
Ha, what sort of idiot would have private data on a non-English site? Oh wait, that would be the majority of the population of the planet.
Why does divshot requires all this permissions?
Yesterday I try to sign up to divshot with my github account, but I abort that after this:

This application will be able to read and write all user data. This includes the following:

Private email addresses
Profile information
Followers

Why does it ask for write permissions?
Was there an issue with truecrypt?
If the ISPs already complained about extra costs, I wonder if most EU national secret agencies could pull it off on their own. Even if they had direct access, the infrastructure for the storage and querying of all (header) data of all the ISPs.

They don't all have billion dollar budgets like the NSA+GHCQ (which is the main reason I think it's fair to be infuriated with people that are okay with the global privacy breaches as long as it's not US citizens because "the secret agency in my country is doing just the same"--except they're not, they'd love to[0], but they don't have the resources to pull it off on the frankly insane and megalomaniac scale as NSA+GHCQ do).

That's the benefit of decentralizing, I guess.

[0] for the Dutch-reading HNers, in case you thought our AIVD are really basically just nice guys, check Louis Seveke's story http://www.vn.nl/Standaard-Media-Pagina/Louis-Seveke-kwelgee... (and no Seveke was absolutely no saint either, but they went too far and back in those days you had to physically tail someone, so at least it didn't scale very well)
Stiff, I think you answered your own question. Intel HIRES them, open source projects don't generally hire people. They sit around and wait for someone to contribute. Are you truly surprised that a volunteer created software is not as rigorously tested as software created by Intel?
Are you aware of anything good for JIT compilers? Or is that more trawling throu dozens of papers material?
It seems to be in fashion to have similar style webpages these days. I don't like them. I assume they are designed for mobile.
OSH Park has a 5mil trace/spacing 4 layer option. No e-test (Got burned by that one. Always double-check your boards before assembly!) and the schedule is a bit unpredictable.

There are a few options for 6+ layers that don't seem too unreasonable. For example, Pheonix PCB does 100sqin of 6-layer board for a single design for $550. They go down to 4mil trace/spacing and 8mil drill (about $90 extra). There might be better options. At this point, for the hobbyist market, design tools start to be the barrier, not manufacturing. $500 for a bunch of prototype boards seems like peanuts compared to the price of Alitum.
Because it wasn't.

I was there at the talk and while he put a humorous spin on it by playing the part of a NSA agent, it's also extremely insightful to see it from that point of view. And yeah, when you really think about it... OpenSSL is the NSA's playtoy.

Of course, there's no way to prove that. But really, does it matter? Whether the NSA is behind OpenSSL sucking or not... we have to assume they know of several backdoors/exploits, and the OpenSSL API still sucks and prevents people from doing productive crypto.
Mine was set to public, too, and I didn't actually realize it because it had been so long (a couple years?) since I had posted anything. When I was editing a post, I was prompted to review the settings ... and I changed it to "friends only". I appreciated the notification.
I really like this, when I'm done with trying to create a JIT compiler I think I'll move on to building a mini-OS in my spare time. I'm sure this combined with this [1] will be a great course unto itself.

[1] http://samypesse.github.io/How-to-Make-a-Computer-Operating-...
to quote from [0,p67], which is the dissertation of the guy writing it:

The HeartbeatResponse must contain the same payload as the
request it answers, which allows the requesting peer to verify it. This is necessary
to distinguish expected responses from delayed ones of previous requests, which can
occur because of the unreliable transport.

[0] http://duepublico.uni-duisburg-essen.de/servlets/DerivateSer...
There's a talk that was given in Belgium / Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he'd do it if he had to create holes in software:

http://www.youtube.com/watch?v=fwcl17Q0bpk

He's talking specifically about OpenSSL quite a lot (basically saying it's too complex to ever be secure and probably received many "security patches" from NSA employees).

The entire talk is an eye opener. He explains how NSA shills are reading reddit / HN and poisoning communities / standards / protocols / etc. How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things.

He talks about shills submitting a few correct patches over the months / years, slowly gaining reputation among the community and then misusing that trust to submit (not so) subtle patches introducing security holes on purpose.

He mentions a few of the "common mantra" repeated often (including here) by people who have an interest in the status quo.

He explains why SSL/TLS is broken and says that the "SEC" part of "DNSSEC" is not going to be that secure ; )

I think that the problem is much worse than most people think and that Poul-Henning Kamp is closer to the truth than the ones constantly repeating "bug happens" as if nothing malicious was ever going on.
Perhaps they assume all software is buggy, so they may as well own the bugs?
Interestingly there is another article by Walter Bright on writing your own compiler on DrDobbs [1] in which he explicitly recommends to write the parser yourself and I have received similar advice by others that know how to implement compilers. My personal experience in implementing a subset of C turned out similar.

[1]: http://www.drdobbs.com/architecture-and-design/so-you-want-t...
Ultracoin Miner Config Generator
As with all things: necessity dictates, curiosity nudges.

If you come without baggage (project idea, interest in FP,
what-have-you), you'll need to come back later.
Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack
Is the ReactOS kernel clean?
* T-Systems was never state-owned. The German Federal Post used to be state owned but was split into separate post, communications and banking divisions in 1995. Deutsche Telekom IPO'd in 1996. T-Systems was founded in 2000 as a subsidiary of Deutsche Telekom. The German state currently holds around 15% of Deutsche Telekom stock.

* RFC 6520 was published in February 2012. At that time Robin Seggelmann wasn't employed by T-Systems but was instead writing his dissertation at the University of Duisburg-Essen [1].

* His dissertation [2] actually gives an explanation for the payload:

"The payload of the HeartbeatRequest can be chosen by the implementation, for example simple sequence numbers or something more elaborate. The HeartbeatResponse must contain the same payload as the request it answers, which allows the requesting peer to verify it. This is necessary
to distinguish expected responses from delayed ones of previous requests, which can occur because of the unreliable transport."

[1] http://www.robin-seggelmann.de/

[2] http://duepublico.uni-duisburg-essen.de/servlets/DerivateSer...
Still works...

http://i.imgur.com/RLXeySY.png
If you just upvote it, it'll appear in /saved, no need to comment :)

https://news.ycombinator.com/saved?id=[nickname]
> Maybe a big name in software could go and write a modern crypto library without all the cruft of OpenSSL but for now we have to deal with it.

https://xkcd.com/927/

There are very few competent FOSS crypto implementers, and unfortunately, they're spread very thinly. I'm not sure that having yet one another crypto library is going to be helpful unless we actively move our users to the new library and kill the old projects.
Author here. Per many requests, here is an annotated version https://gist.github.com/justecorruptio/10248923
I understand, and I'll fix it.
Thanks.
For real: Committed revision #8000.
https://twitter.com/jparicka/status/453824024368644096
Yeah I'm doing that right now. I find it relatively easy, it's a good introduction course, gives a good overview, but you probably want to take a follow-up course that builds on top of that one to really get into ML. (I'm aiming for the Neural Networks course on Coursera, and then I want to look into decision trees and Bayesian networks)