skysight-inc/HackerNews huggingface dataset:
While I agree with the author's message, I can't say that any other alternative is more trustworthy.

At least in the case of FOSS, the general public is able to review and catch issues like this. In the case of Apple or Microsoft, there's not much you can do when they say, 'trust us, it's secure'.

Also, what was up with the slight dig at systemd? Can anyone explain why systemd is such a hot topic? I've been using it for almost a year now, and I find it much easier than the alternatives...
I feel obligated to add that you really want a dark room for projector, and either opaque curtain or blinds. Viewing movies on projector is not that nice when the living room walls are bright and/or a lot of light comes into room from outside.
Wonderfully dark, the music (March Slav by Tchaikovsky) only makes it better..
IOS Dev Tools – A collection of great iOS development tools
Very interesting theory! Google must not have realized this because all of the google apps are in a single folder. Still, my home screen is 4 out of 20: Google folder, Gmail, Chrome and Authenticator.
Sure, it'd be great if the author open sourced it if he's no longer interested in doing it, but whatever. My license is still valid, and it still does everything I paid for it to do. If someone wants to take up the charge and make a better version, it looks like there's a market for that.
I know this feeling. One-man bands are especially prone to "Valve time." On 4chan, "soon" basically means "anywhere between an hour from now and never."
It strikes me that this might be incredibly useful in inducing a feeling of frustration in subjects of psychological studies.
The sentence is a bit misleading. Red Hat are the biggest single contributor to open source software when viewed by which developer works for which company.
I used to use UltraEdit on the PC, but they were slow to get their OSX version to market, and wound up sticking with Sublime Text 2. I'll need to check if their recent Mac builds up-to-par with what they used to offer on the PC?
> More importantly, this rule is simple. Having a simple, strict rule like this will help people help themselves.

Even more importantly, having a simple, strict rule like this encourages people to think along these lines and find other behavioral anti-patterns also deserving of rules.
No. Vim is opensource and developed by a community.
There seems to be some psychological barrier that prevents people from learning Lisp (or Scheme for that matter).

i think that the problem is that of nesting parenthesis; Multiple nestings of parenthesis assume that the information hidden in the inner levels of parenthesis nesting is somehow different/or hidden from the outer levels.

I think that a complicated system must combine multiple level of 'truths'; a fact that is definitely true on a lower level might end up as being of less significance on a higher level (or vice versa - the process of debugging turns designs on to its heads; some philosophers (see Hegel) call that 'dialectics').

Now people who are used to censorship have no problem with that ! A person who is supposed to hide his stuff - he is a person who must be afraid of external censorship; this person is used to social hierarchy; he knows that the lower level (his personal self) knows things that are different from what is regarded as public truth.

Now assume that society opened up (somehow) since the fifties; people who grow up during later timers are less accustomed to multiple levels of truths; therefore this hierarchy of parenthesis will be regarded as oppressive/disconcerting to subsequent generations.
I don't have numbers from Instruments, but anecdatally ;), both my wife and I experienced substantially shorter battery life when we had Messenger installed because it was always waking up in the background—even if we weren't using it.

Messenger may be a little more efficient when running, but it wants to run all the time, which is less efficient.

http://www.tuaw.com/2013/06/04/developer-suspects-facebook-a...
http://www.reddit.com/r/iphone/comments/1xyap9/
I wrote an article called, "Why you think the PKI sucks but can't do any better" that goes over every single proposed alternative to it and explains why none of them work:

https://medium.com/p/d04ea6a2c771

It's also got links to various security usability studies that are required reading for anyone who cares about this space.

tl;dr - the article is dumb, heartbleed doesn't even have anything to do with X.509.
Visual feedback when user executes a short cut.
Atom really annoyed me to be honest, I wouldn't have bothered requesting a beta invite if I knew it was Mac only at the moment.

Furthermore, why is Windows and Linux only an afterthought here? That suggests to me that further down the road, new updates and bug fixes will be released for the Mac version, with the Windows and Linux versions left to suffer.

I'll stick with Sublime and VIM for the foreseeable, thanks.
Other MIT Open Courseware:

Recently my memories of the first time I saw linear programming were triggered- those few pages in an algebra book were the last time for many many years that I felt "wow this is so cool" about math and I think part of my loss of interest during high school and pretty much entirely by college was that the subject was never revisited and instead there was a lot of looking stuff up in tables and not much with systems.

Anyway, I've been watching Gilbert Strang teach Linear Algebra on OCW. It makes me wish Abelson and Sussman could remake the SICP videos with another 25 years of in the classroom experience - Strang's presentation is masterful. And linear algebra after all these years is still awesome

http://ocw.mit.edu/courses/mathematics/18-06-linear-algebra-...
Debian's 2006 PRNG anyone?! Maybe these are stupid dumb mistakes, but if I were NSA this is exactly how I'd implement backdoors. 2 lines of code cloned here (go to fail), 2 lines of code commented out there (Debian PRNG issue), and just like that you create huge vulnerabilities in the system. Hard to notice, and impossible to blame on anyone. Everytime they seem to be some brilliant "stupid mistakes".

And as others have said, do listen to the FreeBSD developer's talk on NSA' ORCHESTRA operation (subverting open source projects):

https://www.youtube.com/watch?v=fwcl17Q0bpk
I would take anyone for a fool who thought the NSA hasn't been using heartbleed.
The boringly mainstream solution to climate change
A barrier to entry...like 7 years of med training ans state licensing...
Who is upvoting this BS... This article is just link-bait and FUD...
Nowhere in the video (http://www.youtube.com/watch?v=UFFTYRWB0Tk) does Julian Assange say that "Debian Is Owned By The NSA" as the article title implies.
All he says is that open-source systems are still vulnerable to attacks by APTs such as nation-states through the introduction of backdoors disguised as bugs...
Or maybe it just won't 'change the way you think about coding'
Heartbleed bug: which passwords should you change?
Conspiracy theorists do not need evidences, only feelings.
I don't think this is a solution. I've been thinking about this for the past couple of days, after watching some Alan Kay talks and revisiting some of Bret Victor's articles.

I think the fundamental problem here is about structured semantic content and its presentation. When those two domains meet, it gets messy very, very quickly. At a certain point it gets hard to tell the two areas apart, especially when it comes to interactive applications.

Hardcore HTML advocates such as Zeldman seem to have the worldview of 19th century librarians (no offense intended). I find it outright irritating that a board could define some semantic elements (header, article, section, etc.) and expect the world to be happy with this limited array for expressing 'meaning' and 'intent'. And again, it's often hard to divorce the meaning of content from its actual presentation.
One thing i wonder though: i first wanted to code that lisp in haskell (learning two languages in one), but i'm not quite sure it's such a good idea, now that i've learned about homoiconicity.

Any advice ?
Creating data layouts with jQuery
Textmate had that mind share for a while. That one man shop pretty much stoppped. I see no reason why Sublime won't go that way if other developers (somehow) aren't brought in.
See also https://madeye.io/pages/docs

Though it's pretty smooth when testing with a little 100-file project, the obvious concern I'd have is that you are hosting your code and the data is running through their server... nothing prevents them from simply slurping down people's repositories...
Google Wants To Get Better At Indexing Your Business Info
It wouldn't just be the browsers removing the CA. There would be a strong incentive for websites to switch as well, particularly foreign ones, so you'd find a mass exodus anyway, even without browser support.

Browsers don't have to turn a root CA off all at once, either. They could start by turning off Extended Validation for the compromised CA, or they could release a statement saying that if they don't get guarantees this won't happen again, they'll remove the CA in a year's time. They could allow connections, but change the SSL icon to indicate the certificate has been compromised. Browsers have a lot of options to put pressure on root CAs, even without removing the cert.
There's a difference between constructive negative feedback and trying to subtly belittle someone.

Not knowing about something is not really a negative feedback point
I really don't believe the OpenSSL issue was deliberate. The commit in question was authored by somebody working at a german university and then reviewed by a member of the OpenSSL project.

Deliberately setting up something like this up would have been very difficult and besides, these people are likely still around and we can ask them what happened.

I really think that this was a) a honest mistake of the author and b) a very good example of why code reviews don't always work, at least for languages like C.

http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=4817...

That commit is widely publicised by now and the fact that the article linked here is still speculating about this issue being deliberate puts the whole article in a alarmist light which makes me sceptical about the other claims.
Yes, that's because browsers don't want to put security of hundreds of millions of users in the hands of any Joe Random that asks for it. Running a CA is expensive because they are held to very high standards. You need to have your root keys inside an HSM, you need to have multiple people on your board who can access those keys, you need to set policies for certificate issuance that meet the CA/B requirements, you need to run OCSP servers, you need to be audited by a third party to verify you're actually following all those rules, all those things take money so then you need billing and charging people money implies you need support. In future you may need to take part in the CT audit logging system as well.

Taking out any of these things and you'd be left with something that is significantly worse.

That's why it costs money to be a CA _that browsers trust_. Of course if you want to be a CA that doesn't care about browsers, that's like three lines of code at the command line.

This does not mean that the CA system is broken. There's a huge middle ground between "anyone can do it for free" and "totalitarian oligopoly". $1M to start a business is not that high compared to many other businesses.
"No sessions available."

I guess I expected a video archive, not unlike the SICP playlist as it exists on YouTube in various forms.
Its not about conspiracy theorists.. Its about misrepresentation and putting words in people's mouths.

This article is far below the standards expected of the Hacker News community.
It's lost the "great new editor" mind think. Too long between "I am developing the new one", long pause, "I am open sourcing it".
Yes, just checked and the guidelines do mention there is a karma threshold.
Well I'll give you this example.

If Facebook would release 3 Facebook apps, where each has mostly the same features, but slightly different, and on top of that each requires a different user/login, that's definitely fragmentation.

Say, you can argue WhatsApp and Facebook Messenger, or Instagram and Facebook picture posting represent fragmentation for Facebook, as they do mostly the same thing, but are each in their own space and with their own APIs and their own users etc.

Another example. iOS having lots of apps in one App Store is not "app store fragmentation". But Android having many separate app stores, many apps in each being the same (but tweaked or different versions) is "app store fragmentation".
IMO Systemd is such a hot topic because it is written by Poettering. He has a reputation of writing/being responsible for borderline broken software (PulseAudio and Networkmanager still crash on my brand new Ubuntu) and being an asshole.

In this case it seems mostly a personal thing. The technical changes are also huge, and there is a complete paradigm shift that many people do dislike. Also many people see all these software as solution in search of a real problem, while they add lots of complexity. Now put on your tin foil head and see where this is going. (DBus support breaks Pidings OTR encryption btw.)
I totally understand the reasoning.

Re: personal + shared folder, that starts to get a little messy when you're sharing folders/joining shared folders with outside people. Doable, but messy. Another option is one account for the business, with e.g. 2 people logged into it. I do this, plus a hacky workaround to also have a personal account logged in on my laptop.
And if it was discovered, that CA would be revoked at huge cost and a ton of people would be very unhappy.

Does the US Govt care? Maybe ... there are no references to such a root key seizure in any of his docs so far. Or maybe not. Just lots of talk about stealing private keys directly from the original holders. But who can really know?

Suffice it to say there are attackers in this world other than the NSA.
There were 3 years between vim 7.3 and 7.4 releases, but nobody has ever thought vim was dead.
Or Xcode.
The most interesting HTML/JS/DOM/CSS hacks that most devs don't know about
> But that's wrong. If I have strong dynamic typing and the program never goes to that part of the code, I don't get an error.

Exactly.

> It will still complain if you muck things up when you type them into the repl. Dynamically.

Yeah, because it's a REPL so it has to evaluate every line of code that you give it. How does that work when you have code as a file and you run the main function of that file? You would have to run every line of the code. So what about code paths that are not taken? Do you just give enough input data that eventually all code has been run through? But then you 're not really running the main function, you're running all the code of that program has, with whatever results and output that that might give. Obviously I'm not talking about Haskell here, which already has a static type system.

Is your claim that you don't need a compiler to do type checking? Well, yeah, since type checking is not part of the source code translation. But it often said to be part of a compiler since it it often is often part of the semantic analysis phase. But if you have an interpreter you wouldn't really have a compiler as in a program translator.

I interpreted 'The interpreter can just complain to you when you try to run it.' as "complain to you as you are running it". Not "complain right before you run it".
And in case one's living in a third-world country when their income is, say, $600/mo, I think $15/mo is a bit pricey.
It was done because using WebKit on Mac is ten times easier then Windows/Linux. It makes for a faster/easier mvp.

While Windows/Linux are also fairly easy to implement using CEF, they didn't do that. And instead opted for using the Mac built in WebKit libraries.
Agreed - my comment is to emphasize how doing such is a complete waste of an opportunity for everyone.
Atom.io build for linux
It doesn't look like it's the case with Vim - https://github.com/neovim/neovim

The wiki gives a good overview of the problems with current Vim https://github.com/neovim/neovim/wiki/Introduction#problem
Here's how fusion research has moved beyond hype and empty promises
I think this comes under the heading of squabbling over details.

To quote from your blog post:

"This is a sign that still performances, even in security critical code, is regarded with too much respect over safety. In this specific instance, it must be admitted that probably when the OpenSSL developers wrapped malloc, they never though of security implications by doing so. However the fact that they cared about a low-level detail like the allocation functions in some system is a sign of deep concerns about performances, while they should be more deeply concerned about the correctness / safety of the system."

As you stated in this bit of your post this is a sign that the OpenSSL team have their priorities backward. In other words they are NOT fit to run a security critical project. Period.
To Clarify, banning illegal downloading sounds quite logical.

Until now, downloading of copyrighted material such as movies, tv shows and music was allowed for personal use. This apparently has been overruled by an EU court. Quite interested to see what this is going to change....
I have never seen an ad in messenger.
Perhaps Debian will get more funding, now when it is officially out :-)
I'd imagine the companies providing seedboxes in the Netherlands may have a lot of work to do.
Sleep Calculator – go to sleep and wake up feeling energized and refreshed
Computer Misuse Act 1990, section 1.1. The test for the vulnerability requires running the exploit, whose only function is to secure unauthorised access to data held on the remote machine. Seems fairly clear-cut to me.
I solved the jump/gravity level without having to edit any code, dunno if that's supposed to be possible, but: if you press+hold the UP key, keyboard repeat rate will be fast enough that you "fly", allowing you to cross the gap (and even save yourself if you happen to fall in it).

I also solved the DOM level without editing anything, I just pressed some keys and it transported me to the next level before I even had an idea what was going on.

(im playing on Firefox / Linux, in case that makes a difference)

Oh and thanks for this game, it's EXTREMELY COOL and I had a lot of fun playing it all the way to the credits screen (and I'm going to go back now to see if that's really the last level or not ...)
Nope. Technically correct (it is open source), but Vim in reality is mostly a one man show, 90% developed by Bram.
This sounds like an emotional response. The video in question doesn't claim what the article title states.
There's something scary in this experience. You're conditioned by years of Tetris to expect that sweet gratification, but it never comes. All your errors will haunt you forever, and you will never get any reward for your achievements.
Interesting that you pick up on those words, as I have noticed that whenever my team leader asks me for "just a small change", it usually means he hasn't bothered to think it through properly, and it will involve a lot more thinking or work or maintenance in the long run than he imagines.
In what way is OmniFocus a 'toy'? It's a powerful GTD tool with iPhone and iPad clients, and a thriving beta testing community currently testing v2.
Developers do get tired and burn out.
It's about time they did.
It also includes quite some information that isn't exactly right.
I can think of one more trustworthy alternative: formal verification. seL4 is a formally verified microkernel [1]. There are formally verified compilers [2] and web browsers [3]. And formally verified formal verifiers. :-)

[1] http://ssrg.nicta.com.au/projects/seL4/

[2] http://compcert.inria.fr/

[3] http://goto.ucsd.edu/quark/
"they only can be distributed to those states US agrees with,etc."
That is incorrect. The clause that you're basing this on is for encryption software export. http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_U...
Swedish ISP deletes all retained customer data in wake of EU court ruling
I don't think the Linux malloc implementation is why OpenSSL has some of it's own memory management stuff built in. I think it's more due to the wide range of other platforms it runs on, including some embedded ones that have very strict allocation policies.

jemalloc may very well be a good thing for Linux in general but I don't think it would have changed this.
I read it, and how I think about coding remains the same as before I read it.
Why was this downvoted? Seems like sound advice not to drop the keys to your kingdom into a black box run by a business...
Handy Open Source Spree Extension for Adding Q&A Sections to Product
I believe the stress on performances is largely community-driven in a project like OpenSSL. A lot of environments did not switched to encrypted connections because of cost concerns and unfortunately costs are related to OpenSSL performances. So it's not like they are crazy and mess with priorities IMHO. But it is time to re-evaluate.
A while ago Sublime Text 2 announced that the current version was now outdated, fair enough. However it didn't let me use the program any more, suggesting I go and update.

Roughing it with Notepad++ now.
TextMate was just a one man show (with lots of community support) for quite a while. Might still be actually, although I think there were a couple of other people full time on it for a while.
Why must we have an "us and them" attitude to distributions, instead of helping to make them better?

Free Software does not guarantee against nefarious third party manipulation. But it does guarantee that you can study the code that is running on your system.

Debian goes to great lengths to make sure that the binaries you get really can be built from the sources claimed (eg. random binary blobs embedded in source trees are not acceptable).

What users do next is up to them, but I think Debian is an example of the best we have. We are really better off gathering around open projects like Debian, than slating it for what it is.

It seems to me that the root cause of this "botching" is of not enough (qualified) eyes and hands working on making the code base better; if the upstream OpenSSL project had a decent, best practice, well commented code base with no build time warnings, no spaghetti code and decent test suite coverage, then no "botching" would have happened.

I think we have the best framework for fixing this problem: Free Software and Free Software distributions. What we should be talking about is how to make things better within this framework. And this just comes down to hard work, which everybody seems to expect somebody else to be doing.

I find it very difficult to accept the critics who are happy to use OpenSSL but also are not committing any resources to making it better. If the NSA really were the only major contributor to a Free Software project, then sure - they'd own it.
You'd learn a lot more and more quickly by having a conversation with those that know more than you do.
Condoleezza Rice Joins Dropbox’s Board As It Names New CFO, COO
Just a proof that freemium model doesn't work.
Right, but...

I have about 30 certificates from StartSSL. Four second-level domains, and best security practices recommended having a separate key per service, so web server has its own keys, so is email server, XMPP and so on. The idea was that if one's compromised - others would hopefully remain safe.

Call me names, but I'm not going to shell out $750.
It can also be a problem with micro-managing and fear of delegation. Speaking more from personal experience than to this project. As a one man outfit it can be difficult to let go of something you're so attached to.
Maybe it doesn't want to pass through a Google service.