skysight-inc/HackerNews huggingface dataset:
First off, my quibbles about the definition of front running vs predatory trading are unrelated to my defense. The defense I gave was about price discrimination. It doesn't matter what label you apply to the definition - if you want to argue against me then say why price discrimination is bad. Or say I'm wrong about price discrimination.

Second, the "spirit of the regulation" about front running is about allowing people to trust their agents. Other regulations in the same spirit are lawyer-client confidentiality and "financial advisers can't take gifts from companies they give advice on" regulations.

There are no "you can't kick people's ass in the stock market" regulations, in letter or spirit. If you play the stock market everyone is trying to take your money. You are trying to take theirs.
How To TUNE TCP PARAMETERS ON HIGH LATENCY NETWORKS
While Haskell mitigates or eliminates some classes of bugs common in C (such as buffer overflow), it also makes it more difficult to guard against side-channel attacks like timing attacks[0], because lazy evaluation makes it more difficult to reason about the actual behavior of the code at runtime.

This isn't a dig at either Haskell or C; the point is that all programming languages and environments have their "gotcha!" moments.

[0] https://en.wikipedia.org/wiki/Timing_attack
Google Seems To Be Considering Doing More With Chromecast’s Home Screen
Another company that is in the same space: http://www.farmlink.com/true-harvest.html They provide benchmarking data for farmers to understand how their yield compares to other farmers.
Very useful! How about Linux?
> This is the best criticism of soylent

I disagree. With sex, the enjoyment can be had no matter what, while the biological part (reproduction) is optional. But with food, it's often a mutually exclusive choice between enjoyment and biology (proper nutrition). Especially when you have three dollars and ten minutes to spare. So it isn't quite a valid comparison.
Bank account - 15,000

Karma + 1,000,000
Maybe Rust will provide the right balance between the two.
That sounds like a reasonably trustworthy set of people if they're ideological opponents.
I used DataDomain before. It's quite useful in virtualization environment.
I have no answers. However, with the EU Parliament elections coming on May 22, I hope that someone with a less goldfish-like memory than mine may try to collate what the various electoral options may be.

Evidently, none of the big three UK political parties have any interest in reining in GCHQ, just as neither the Democrats nor Republicans have any interest in constraining the NSA. Who does wish to pull that leash back?
Well, I think it is part of the table.

http://codebase64.org/doku.php?id=base:fast_8bit_multiplicat...

But the C64 had also a shifting operation.
The bar Soylent needs to clear is not the ideal perfect diet that scientists may discover one day, but rather the diet of average joe in 2014. Not a very high bar.
Newegg to collect Indiana sales tax
On Sunday, April 6, Newegg opened a new, state-of-the-art warehouse in Indianapolis and began processing orders. The new facility will be a huge step forward for Newegg and, while many States were considered, Indiana presented the best solution.

While we are proud of our new facility and the faster shipping times it means to everyone in the Midwest, it also means we now have to charge sales tax on all orders in Indiana. So we’d like to offer you three months of Premier membership for free. Newegg Premier benefits include free expedited shipping, free returns, and exclusive deals and alerts. You’ll also be able to continue your Premier subscription after your trial, for just $49.99 per year.
Back in the days when I was running pretty large SEO company (at its peak it was around 500 small businesses using us) few of guys in this field chimmed in and got some heavy testing done. This was done around penguin or panda update (not sure though). We have got 200 domains with no SEO done to them before, got some Wordpress blogs and started testing trying to see how accurate Matt Cutts suggestions were. Unfortunately results were not only mostly random, but also pretty opposite to what we have learned from Matt. Websites that were spammed (but in smart way) were ranking pretty good, while WH sites barely made to top 20 for targeted keywords.
You can see tons of examples like that around the marketing forums. I am wondering if Google overgrown itself algorithm wise and if they still know whats going on there.
I put the CVE id in my "reason" and it went through with no charge.
No programming language seems to provide primitives for constant-time algorithms.

At this point, gcc and clang should at least provide constant time memcmp primitives; any custom solution not supported by the compiler is not portable and needs to be validated separately for each implementation, each platform, each compiler version.
15k? Heartbleed bug worth more like $1M
It appears to be a lamp, but other than that, I'm clueless too.
Gotta try that after i catched some sleep. Got no reply from them on twitter.
I'd expect them to an annouce this officialy though.
I don't think they actually are that similar.

Ensure doesn't even get you close to the recommended amount of macronutrients, unless you're trying to lose weight. Ensure has 210-350 calories [0], yet high levels of micronutrients which means if you drink too many of them you risk taking in way too much of some vitamins and minerals.

Soylent is meant for healthy people who want to consume a normal amount of macro and micro nutrients each day.

[0] http://ensure.com/nutrition-faq
Every "automation" - here IT wise I assume would be vulnerable to hackers, scam (who is maintaining this system, whats his role, who controls maintenance etc?) and other issues.
As far as I am a big fan of voting system for investments within the community, full automating government, banks etc is simply impossible.
Ah, I thought commbank was on IIS. I checked it when I posted that message and it came up green.
No. That is a capability provided by an extension called CertPatrol, at least in the Firefox ecosystem.
Could you share some other similar devices you've seen?
Very interesting. I was thinking something similar could be done in Haskell.
part of the meaning of the word "intentionally" suggests "for that reason" not plainly "on purpose".
So we should choose the approach that gives us trivial attacks that reveal 64K straight out of Compton to the approach that may be slightly harder to defend against timing attacks?
Realistically, regardless of any company's stated policy or array of settings that can be tweaked, if it goes on the internet - it will be available somewhere to someone forever. This is the ideal situation which bars data breach or misconfigured settings which erroneously releases the data to a greater group than specified.
This is a great reminder for others to consider a donation to the Freedom of the Press foundation's ongoing campaign to fund the development of encryption tools to benefit journalists, sources, and everyone who communicates digitally!

https://pressfreedomfoundation.org/

Huge thanks to Neel, whose donation pushed us over the edge to meet our goal!

(Full disclosure: I work for the Freedom of the Press Foundation)
http://golang.org/pkg/crypto/subtle/
Perhaps it would be more interesting to discuss how the author of the Haskell TLS/SSL library gets around timing attacks. Actually I have him on twitter... paging @vincenthz.

Timing attacks is the first thing I thought of when I saw this implementation so this should be interesting if he can respond.
That's a nice link bait title on the Post's part. I thought it was going to be along the lines of privacy invasion, but it's actually giving the user more granular control over their content. That's good. But I forgot that any kind of change to Facebook is supposed to cause an uproar, so I guess the post is trying to get that crowd going.

Also I love the off screen cellphone picture of the new drop down menu. It really adds to context to the writers commitment to getting a good story.
Relevant HN post: https://news.ycombinator.com/item?id=7538972
Simple(ish) example of using strictness annotations with folds:

http://www.haskell.org/haskellwiki/Foldr_Foldl_Foldl%27
Apparently I'm extremely oversensitive. I'll focus more on not caring about potentially racist, sexist, ageist, Marxist, time-ist, technologist, social, political, extremist, terrorist, traveler's, vice-user, or otherwise self-destructive motives I see expressed by other humans.
Reddit users generate list of games affected by GameSpy shutdown
Because for startup to survive it needs to take minimal time from paper napkin idea pitch to production deployment. And RoR has all the bells and whistles packaged together.
The quicker the time - the quicker VC's gets return on their investment.

Having said that, please note that ruby on rails is one of the slowest performing frameworks:

http://www.techempower.com/benchmarks/#section=data-r8&hw=i7...
I encoded a route.

moves = [['down', 5], ['right', 20], ['up', 1] /* and so on */]
How to build a Rails 4.0 app with authentication from scratch
GNUTls? Code hygiene? You have to be joking...seriously...you must be joking
The Race to Locate Twitter Users
The core python devs don't really care about DSLs.
There are two problems in Firefox:

* The excepted site displays the exact same padlock icon as hacker news for example

* "Add exception permanently" is selected by default.
V8 is a JIT interpreter. The performance benefit might be less than you would think.
I am not sure how true this is anymore. As far as I am aware, for example, a lot of the equipment necessary for using tunnels as bunkers in case of war has been abandoned or removed.

At least in Germany, in the past a lot of bridged also were prepared to be blown (especially those to the east). I think this is no longer true for anything that was built after ~1990.
Understandable, admins would just have to start treating OCSP like they do DNS (if it fails you can't visit site).
To a certain degree I agree with you (especially maintenance, etc.) However, we do already partially rely on systems which are similarly vulnerable to hackers. Maybe this statement is naive, but I don't think it's impossible to design a system that is impossible to hack (given enough resources) or at least one that would require so many resource that it wouldn't be feasible to accomplish. The other part of that would be internal tampering, perhaps solved with a publicly viewable log of every action taken within the system? (Yes we may still have problems with tampering, but that's not any different than our current system.) Jobs that require humans can definitely still be part of the government by operating as a manual module that has computer based I/O (think MTurk with government workers), but decision making would be left up to the people and that's what would determine what tasks should be accomplished.
The question is: do you require pricing data in advance of those you are trading with to earn your spread?

If you do, you are not providing a service to the market.
that's great! the victim was lucky they found her.I hope she'll get her laptop back.It's likely the thief is used to that kind of actions in coffee-shops. Seems she has a consistent modus operandi.
What I don't understand is why there aren't companies around that have an interest in improving this software and pay ~1-5 people ~1 million to rewrite it in a year.
This is the first computer game I ever played. My mom was a secretary at a local university, and there was a computer lab across the hall from her office. I'd go there after school to wait for a ride home, and someone logged me in and set me on my way. This was all on paper-feed terminals and I'd take the stack of printout homes and read through each game over and over. This is when I fell in love with computers.

In the early nineties I decided to learn about unix, and this was the first game I played after setting my first BSD box up. This is when I fell in love with unix.

Thanks for the game, to the original programmer(s) to all the people who have kept it alive. This program is special to me.
Seems they've already changed the name to Hoefler & Co on their website[1]. Also interesting that Frere-Jones isn't exclusively using ahis own typefaces on his own website[2], likely due to them being owned by Hoefler.

H&FJ make some of my favorite typefaces; it's a shame their relationship has come to an end.

1. http://www.typography.com/
2. http://www.frerejones.com/

EDIT: Whoops, looks like MyFonts attributed it to different designers http://www.myfonts.com/fonts/fontbureau/benton-modern-displa...
Look at it this way. If it was closed source, the fix would take longer, and the realization may have never come.

Honestly, seems like we are forgetting our roots on this. Dump it? Yeah and throw out years of stability and bug fixes. No thanks!
Some of that was actually built-in to the calculator. The "→Q" and "→Q𝛑" functions took a floating-point number and return a rational number or rational expression in terms of pi. The tolerance for the approximation was determined by how many significant digits the calculator was configured to display. It was pretty nice for a calculator that didn't include a computer algebra system.
You should look at clans that specifically focus on older gamers. I was with TOG[1] for a long time. They are a great bunch of people!

[1]http://www.theoldergamers.com/
/4chan mode off/
The article is about it.
RailsAdmin works with Rails 4.1 and is a good replacement for ActiveAdmin. I have RailsAdmin working in https://github.com/starterkits/rails4-starterkit if you need a reference for config.
In case anyone's curious, here's a link to the libsecurity_ssl source (albeit not totally up to date — latest version is pre-"goto fail;" fix):

http://opensource.apple.com/source/Security/Security-55471/l...
Hacker's Delight [1][2] is an amazing book dedicated to discussing about all kinds of bit hacking, including fast integer square root, cube root calculation.

[1]: http://www.hackersdelight.org/

[2]: http://www.amazon.com/Hackers-Delight-Edition-Henry-Warren/d...
This is such an obvious false dichotomy that I'm sure most people will notice, but I'm pointing it out anyway.

We could use something that gives both advantages, like the OCaml I already mentioned. Or, we could take a hybrid approach, where something like Haskell generates C code that provably can't have buffer problems. Or, we could statically verify that the library is written in a known-memory-safe subset of C++. Or, we could use a language like Rust, which (once it's eventually complete) seems ideal for this sort of application.
It's Not Magic, It's Just Building the Web
Someone with more knowledge please correct me if this is inaccurate, but from what I have been able to understand this basically exposed 16kb of random memory each heartbeat? So the fear would be that a persistent attacker I guess could continuously run this and scan the output trying to match things like security certificates?

While I am sure this could be used on high value targets with enough resources, as a small web service outside of the tech industry I feel pretty confident that no one would invest those kind of resources to steal our SSL cert. Is that misguided?
They aren't all exactly analogous but they're at least in the same category.

http://www.amazon.com/Philips-431643-Personal-Wireless-Frust...

http://lifx.co/

http://www.smarthome.com/2672-222/INSTEON-LED-Bulb/p.aspx

https://www.kickstarter.com/projects/588318042/luma-a-smartl...

https://www.kickstarter.com/projects/ledpulse/led-pulse-an-e...

https://www.kickstarter.com/projects/thingm/blink1-the-usb-r...

https://www.kickstarter.com/projects/2103326826/tangeez-tang...

https://www.kickstarter.com/projects/flashy/flashy?ref=categ...
The bullshit humanitarian obsession of silicon valley.
Log out of all SSL sessions immediately
The heartbleed exploit has disclosed arbitrary server memory, as we speak people are using this to steal session tokens from major services, and using them to log in as effected users.

THIS DOES NOT REQUIRE A MITM TO IMPERSONATE USERS.

Even if the servers have been patched, most do not seem to be invalidating their old sessions, so old stolen sessions will continue to work.

Some major services that did not expire sessions include facebook and steam, which patched openssl but didnt expire tokens.

Friendly note to any devs patching openssl today, please expire your sessions.

https://www.michael-p-davis.com/using-heartbleed-for-hijacking-user-sessions/
I'm really glad she was arrested and I think she deserves a long sentence as a repeat offender. However, I do hope that she won't become an easy target for prison abuse, as it's often the case for transgender people.
Are you purposely being pedantic? Or are you really having trouble differentiating what I mean by "chemical-free" foods from the literal fact that everything consists of chemicals?

EDIT: Removed snark.
Upvoting because there is definitely demand for this service, but not sure it's a good idea. It would encourage a "race-to-the-bottom" type behavior on the part of employers and encourage a situation similar to indentured servitude for those who pressed the panic button.
When I look up my site on alexa, the traffic stats are pretty close to what my analytics are telling me. So, they seem to be reasonably useful, if nothing else in a relative form.
There is already an extension for chrome called "Chromebleed", https://chrome.google.com/webstore/detail/chromebleed/eeoekj...
Go to med school, not grad school.
My bank (PC Financial) has been offline all evening. I wonder if it's related.
You should be able to just dive in. Rails is pretty friendly that way. The starterkit app is just a basic Rails 4.1 app with all the gems. So anything you find in Rails 4.1 tutorials should work just fine.

If you run into any issues, just open an issue on the project and I'll do what I can to help.
Someone still being on 0.9.8 and this not being vulnerable isn't too meaningful as an indicator. If they mysteriously went from 1.0.1f back to 0.9.8 without changing any other part of their configuration, that would be suspicious.

The lulzy thing about this bug is that people who are still on 0.9.8 aren't doing the right thing; they just got lucky on this one bug.
Maybe misguided, maybe not, but it's not too hard to get a new cert from your CA, especially if they revoke+reissue for free.
I am a big fan of their focus on manageability for sharded databases. I am less of a fan of their db internals that might require you to use many more shards than a more performant engine. More details at http://smalldatum.blogspot.com
What's up with the pedantic replies to my comment? I think we all agree that everything is made from chemicals.
With the downside being that things like Heartbleed become possible. Dealing with timing attacks in high-level code is not necessarily hard -- Haskell, for example, has strict evaluation.
I guess we see how well that worked out for them.
Right now there's relatively little risk in credit and identity theft, because people are usually mostly made whole after an event.

As more criminals pour through the holes opened by the NSA and their ilk, it will become difficult and then impossible for most of those victims to be made whole.

At that point you can easily sell security, privacy and good government. That is, if it isn't taken violently at the point of a pitchfork. [Hey, NSA, have you reinforced your buildings?]
VPN relay service to bypass Firewall China
http://hackage.haskell.org/package/securemem implements constant-time bytestring comparisons for haskell. With the bonus that the data is scrubbed when GC'd. This is used by parts of the haskell TLS stack, for example http://hackage.haskell.org/package/cipher-aes

I don't think that laziness makes things much harder. Compare a C function with if foo return 0 in the middle and a Haskell function
that lazily builds thunks that don't end up being evaluated in a particular branch. There's obvious things to do to both to make them run in constant time. The hard part about dealing with a timing attack in both cases is recognising that the function is used in such a context and needs to be constant time.

AFAIK, the haskell TLS stack has not yet been audited. For this reason, there's some reluctance to use it in parts of the Haskell community. Although http-conduit and http-client-tls do use it, so everyone writing programs that hit https from haskell using conduit is using it already.
I totally agree. Generators are the way to go. I just haven't had time to make them for starterkit.

Open an issue or pull request when you get your generators working, and I'll happily link to your project. Always good to give people options.
If you're curious (like I was) if anything else in the Haskell ecosystem is using this, this page lists packages that have dependencies on tls in Hackage (the Haskell package repository). There are 26 packages that depend on tls.

http://packdeps.haskellers.com/reverse/tls

Meanwhile, HsOpenSSL (Haskell bindings for OpenSSL) has 22 dependencies:

http://packdeps.haskellers.com/reverse/HsOpenSSL
Exactly the first thing I thought. There are plenty of side-channels in cryptographic code that require access to somewhat low-level hardware to fix (e.g. the acoustic attack on GPG that got plenty of press), and I don't see how you can address those without e.g. inline C or something else that negates the advantages of using Haskell.
So what candidates are there? While C may make it possible to write code that avoids timing attacks, a quick glance at [1] shows one must avoid memcmp and array lookups based on secret data, neither of which would be prevented by the compiler, and both probably similarly easy mistakes as heartbleed.

Can Rust compile to a shared lib the programs can use as easily as a C library? (I think the answer is "not yet", but I'm not sure? At least, I've seen projects for compiling Rust without any runtime library).

Today I learned this is possible with Ada [2], but it seems there is some boilerplate to start/stop the runtime. Does Ada provide the necessary low-level control to implement crypto?

Are there sufficiently strict dialects of C?

NaCl [1] says "There are an increasing number of cases where the C implementations and assembly-language implementations are automatically generated from code that was actually written in another language, such as CAO or qhasm."

CAO is a "a domain specific language for describing cryptographic software" [3], while qhasm [4] is a portable assembly seemingly not focused on safety.

[1] http://nacl.cr.yp.to/internals.html

[2] http://gcc.gnu.org/onlinedocs/gcc-3.4.3/gnat_ugn_unw/Creatin...

[3] [PDF] http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.113...

[4] http://cr.yp.to/qhasm.html
> how do you possibly deal with refactoring that for consistency when so many other projects are consuming OpenSSL as a library?

You split your project into two components:

1. a new, clean, minimal core with a nice, shiny, new API; and

2. an "OpenSSL emulation layer" that loads your core library, and wraps it in OpenSSL-compatible cruft.

It'd be very similar to, say, replacing Direct3D with OpenGL, and then writing a Direct3D emulation layer that calls OpenGL.
BJP and AAP:THE BIG INDIA ELECTIONS 2014,Emotion Aware Analytics
That sounds plausible, not to mention an excellent way to boost subscriptions.
What would you name it?

#define AND_THEN_A_MIRACLE_OCCURS (0x5f3759df)