skysight-inc/HackerNews huggingface dataset:
Hmm. Would I rather pay a fee every year for my domain name or only if I happen to need to change my name servers, contact info or account password. Perhaps more realistically, pay the host before a transfer or early termination. Yes, getting started might be free, but that just makes accidental lock in easier. Life happens, changes happen. Free should be free, is all I'm saying. Makes for a better internet. Maybe browser vendors should offer free SSL certs, or promote pinning self-signed ones somehow? ;-)
Excuse the formatting above, it seems to have eaten my whitespace.

Just for further reference i recommend reading about OpenSSLs freelists implementation. Essentially if you have an object that uses a specific amount of space it will be stored in a specific location. Which is why private key extraction is possible. You just need to craft a request that puts your_actual_payload in a location so that the 65536 bytes that are read from it into a buffer also end up reading the key.

http://www.tedunangst.com/flak/post/analysis-of-openssl-free...
"You access differences in tax consideration, yes, but that is not the same as getting direct payment."

Of course it is. The public pays money for it.

"Moreover, there are a variety of legal rights that are available to married couples vs. non-married couple and non straight couples deserve access to those rights just the same as anyone else."

As I said, I am not against it. I would argue that those rights are also a subvention.

"Marriage isn't granted or denied to straight people based on their ability to have or not have children, this argument does not hold water"

I'm aware of that - my point is that I can understand if people think about it that way. Also I think there have throughout history been special rules for marriage if a couple can't get children. For example it might have been legal to get another wife, things like that. I don't think you can argue that children have no bearing on marriage whatsoever.

Especially since presumably the "right to adopt" is the main issue people have with gay marriage. Don't know about the US, but where I live, the only other significant right married people get is bringing their spouses into the country (giving them citizenship). Things like "visit your spouse in hospital" or "split your income for tax reductions" can be arranged in other ways.

"this is a question of discrimination of the most basic kind."

That is just hate speech, not an argument.

"That there is a bigger problem compared to gay marriage doesn't negate the fact that some people are still being denied the ability to marry and access the rights that come with that status."

Of course not - my point is that many who now feel like "good people" because they support gay marriage at the same time fight for denying people health care. I just wanted to illustrate that things are not always as obvious as people think.
Are these not powered? How do these things overcome the laws of thermodynamics?
Write a really tiny Python web framework with hundred lines of code
Their stance is entirely correct

Well it sounds like their stance is wrong if they've agreed to the Mozilla CA Certificate Maintenance Policy:

CAs must revoke Certificates that they have issued
upon the occurrence of any of the following events:

...

the CA obtains reasonable evidence that the
subscriber’s private key (corresponding to the
public key in the certificate) has been compromised
This was on HN some time last week: https://news.ycombinator.com/item?id=7521180

Good site, though.
Heartbleed – test, advice and impact
With Oculus' now rather unsavoury connections I really hope documentaries like these will be made available in some format that's easily portable to other VR devices.
As for the plans to support VR at all: Great. I hope this is going to work out well. I can't think of many recordings more deserving of immersive visual experience than those of Sir David Attenborough.
Wohnungsräumung wien
Wohnungsräumung , Wohnungsräumung wien
Herzlich willkommen bei Modern Trans , Ihrem kompetenten und professionellen Partner für Transport, Umzug, internationaler Umzug, Übersiedelung, Entrümpelung, Räumung, Entsorgung, Lagerung und damit in Zusammenhang stehenden weiteren individuell gewünschten Dienstleistungen.
This is compounded by the strange fact that Microsoft's own development tools produce programs which you cannot give to other people to run on a standard Windows install.

If I compile on Linux, I link against libstdc++ version du jour and the binary will just run on a recent distro. If it doesn't you end up in the same spot - you need to install the appropriate .so version, but most of the time things just work.

So Microsoft's stuff links against a system DLL, but I'm not allowed to do that because they can't guarantee full backwards compatibility, so they give me explicitly-numbered DLLs to link against. So why aren't those part of the standard install? It comes on a DVD! It has gigabytes of stuff, surely a few megabytes more won't hurt. It even comes with the .Net runtime and you'll get the latest one pushed to you by Windows Update. It's almost as if they want to push people towards writing C# instead of C++, which due to being a managed language doesn't end up in the situation where you're writing to strange private struct fields... oh...
Well, don't worry, malware writers will generate enough bitcoins to sustain the system.

The cost of mining to them is practically zero.
To better understand the stupidity in leaving the power with the CI for SSL/TLS :

$ gpg --gen-revoke $(whoami)@$(hostname -f)

gpg (GnuPG) 2.0.22; Copyright (C) 2013 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

How would you like to pay us?

(1) Mastercard
(2) VISA
(3) Other

Your selection?

Also, a dark cynical part of me wants to ask exactly what the business model behind "free" SSL certs is? You're not paying them, someone else is?
CIA and FBI had knowledge of variations of this vulnerability nearly 10 years ago.

This isn't true. Don't make things up - this bug is bad enough without misinformation.

OpenSSL has been patching variations of this bug for that whole time

Untrue. OpenSSL has been patching unrelated bugs since it was created (as has most software).

https://www.openssl.org/news/secadv_20030930.txt*

This is unrelated to heartbleed.
> (and is meaningless because by default all browsers ignore revocations)

Strange, because when I revoked my cert at StartSSL yesterday (and payed for it), the browser, Firefox on Ununtu immediately showed it as revoked. With a big bold warning when visiting the page.
That's an excuse?
Ask HN: If NSA knew about Heartbleed, did Snowden know too?
..because what we've seen from the NSA files so far, is only a tiny fraction of what is yet to come. - Edward Snowden

http://www.ted.com/talks/edward_snowden_here_s_how_we_take_back_the_internet

just wondering whether this is a plausible theory,

http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used-heartbleed-bug-exposing-consumers.html

suggests it has been going on for a while, but I'm not very keen on trusting news outlets.
The Apache Software Foundation is one of those. Here are some of their (our) public numbers for 2012-13:

https://www.apache.org/foundation/records/990-2012.pdf
Well done. Everything is accurately explained using simple terminology. I'd love to see this expand beyond just layouts. CSS is overwhelming to beginners, but this is dead simple while still delving into deeper, more complex topics.
HMO/HYO (e-mail in profile)

Short version:

Looking for mentor/peers interested in working on hobby projects in a wide range of programming languages/frameworks - main goal here is to reach a level of decent developer efficiency in many different technologies.

I don't mind if I'm contributing in some way to a startup without being paid, or an open source project, assuming of course the work is educational for me. It's a balance, if I am getting a lot of good mentoring, I wouldn't mind doing some tedious tasks every now and then (documentation etc), because overall I am likely learning more than I would on my own.

Details / longer version:

I'm a software engineer, based in Denmark (Aarhus), completed university roughly a year ago. I don't get to do much actual coding in my job (the coding itself is mostly outsourced), and the little coding I do for work is Java. In my free time I enjoy working on hobby projects or thinking up projects I would like to do - my backlog of project ideas is quite long :). Lately I've gotten to a point where I start actually finishing my projects, where previously I would move on to the next thing before getting far. Projects so far have been nothing with any monetary value, strictly for fun/learning.

The problem is I feel like I'm missing out on a lot of valuable experience, motivation and fun by doing these things alone. I'm not looking for somebody to help me with MY projects, I'm looking for some person or group who I can share my progress with and follow their projects, possibly joining up to work on the same project if interests collide on something.

Topics I'm interested in learning more about (italic = no practical experience with language/platform yet):

- Functional programming languages (especially Clojure, Erlang and Haskell at the moment)

- Web frameworks (django, rails, grails and similar frameworks for other languages)

- Mobile development (Android, maybe Tizen - not iOS)

- Non-relational DBMS's (Cassandra, Riak, Mongo, Couch etc)

- Designing architecture for high-availability / scalability
Just imagine you're linking against the MSVC10 runtime and want to distribute your program to people who run Vista. How could the runtime even be part of the system? It didn't exist back then.

So you have to bundle your dependencies anyway and you need to do that with everything else you use as well. The OS does nothing else: It ships with the dependencies it needs. If there was no program in a standard Windows install that used the C++ runtime (very unlikely, I know), there probably wouldn't be a C++ runtime distributed with it (well, apart for that pesky problem Raymond acknowledges where people link against DLLs included in the system that are not system DLLs – probably the same reason why the VB6 runtime is still part of Windows).
I'd even go as far as to suggest the opposite "be liberal in what you send [1], be conservative in what you accept (and fail as noisily as possible)".

[1]: by this I mean that it's ok if your "liberal" output (by "liberal" I usually mean "assuming newer features not yet widely adopted in other apps it needs to talk with") forces the user to upgrade other components to the latest versions in order to use yours, because if you're in a choice of "f_g the downstream guys" or "making trouble for the upstream guys", you should always choose "f_g the downstream guys", because here "f_g" them only means the minor inconvenience of forcing them to upgrade to decent versions and moves everything forward in the process, and has the added side effect of forcing them to also do their damn security upgrades :)
This is not how the US immigration system works. America issues two types of visas: immigrant and non-immigrant visas. The "green card" in question is, in fact, the end product an immigrant spousal visa (IR1 and CR1). There is also a non-immigrant spousal visa called K-3.

Here in the EU it works differently, as my wife is a family member of an EU citizen (me) she automatically has the right of freedom of movement within the EU. The UK Border Agency has issued her a residence document to confirm her status but it's not a visa or an endorsement in away way; it's just a confirmation of her existing rights.
At godaddy, seems the flare has been lit:

http://support.godaddy.com/godaddy/openssl-and-heartbleed-vu...
That's how I learned Hebrew. There was a service I used, I forget what it was, but it was definitely useful. Essentially I would just login at a scheduled time with my tutor and we would practice Hebrew, her native language. It was pretty expensive, and if I didn't have a scholarship to learn Hebrew at the time, I probably wouldn't have been able to afford it.

It would be interested if...
You could "earn" credits by teaching someone your language, which could be redeemed to learn a language from someone else. It is a workable business model where you basically get teachers for "free" and a certain portion of the users pay into it to get credits.
Without knowing OP's jurisdiction this seems irresponsible. IANAL and OP, you should probably speak to one, but pen testing without permission can absolutely be illegal.
تنبؤات الابراج مع هالة عمر الاحد الاحد13/4/2014 حظك يوم الاحد 1
They should collect enough up front to make the revocation pre-paid. Refusing to revoke certs results in an unsafe internet and ruins the value of the entire service they are supposed to be providing.
Can't you distribute plugins as an archive of compiled, but unlinked .obj files and link them on import to the runtime you use?
Nothing wrong with bashing a free product or service.

If I paint two pieces of art, one I let you view for free, the other I charge to view - are you only entitled to an opinion on the latter?
http://en.wikipedia.org/wiki/Informal_fallacy

"The problem with an informal fallacy often stems from a flaw in reasoning that renders the conclusion unpersuasive. In contrast to a formal fallacy of deduction, the error is not merely a flaw in logic."
Personally, I'd just send a patch to my favorite browser removing their certificate from the trust chain, and then send StartSSL an email with a link to that. Although I doubt anyone will merge your change, it sends a cynical message about how their entire business lives and dies at the whims of people with commit access to the list of trusted CAs.
This is so brilliant that they should be sued for doing it :)
How about protocol buffers?
I'm thinking very sensitive scales to measure both the bread and the plate before and after the test period, which should answer that question definitively.

The question now though is, how much would that condensation weigh? And hence how accurate do the scales need to be?
Because Rockstar [1]. This time around they're not supporting the crazy.

[1] http://en.wikipedia.org/wiki/Rockstar_Consortium

edit: reference
DragonFly BSD 3.6.2 released
It's weird that we're thinking about anything, if you think about it enough.

And your thought raises the question: how much moisture do you actually want in your toast? Is zero acceptable?
Here's a link that describes the technology behind it:
http://newsoffice.mit.edu/2013/how-to-get-fresh-water-out-of...

...and one showing the structure in detail:
http://www.architectureandvision.com/projects/chronological/...

TLDR: Great for pulling moisture out of the air if the air already has a really high moisture content. Pretty much useless in other circumstances.
What if you have two slices of toast on your plate?
They don't refuse, they charge money for this specific service. Protecting your keys is your obligation, not theirs.
Heartbleed Hit List – Websites affected by heart bleed
Have you changed your password? You definitely should do it!
Shouldn't they be there in the first place?

Even better, host on your competitor's servers.
Are people really that good at duping themselves?

Seems metacognition, the ability to reflect on one's own thought process, would be a really good cure for such cognitive dissonance.
Only their entry level certificate is free, they have higher priced options for the likes of wildcard and EV certificates. Once your root certificate has a good level of acceptance, the true cost of certificates is the validation process; actual certificate generation is negligible, hence certificates with little-to-no validation can be offered at little-to-no charge.
> The Mozilla CA policy does not include a provision for obvious trolling and posturing.

This isn't really trolling, after Heartbleed we should consider all SSL certs used by OpenSSL based servers as compromised. This sites just tries to make the point more obvious by putting such compromised cert in public view.
I think you're right, if there's evidence the key is compromised, they should revoke first. Then they should bill you, and if you choose not to pay, they should send it to a collections agency.
So why do I need to distribute it? Why can't it be part of the standard install machinery "oh btw my program needs MSVCR10.DLL be a dear and fetch it from Windows Update"? Heck, this could be embedded in a manifest inside the .exe - "I need these MS libs with these versions" and when you double-click Explorer could parse that, check that those are installed and if not launch a "this program requires additional components installed from Windows Update, please wait".

And I don't want them to ship future versions of the runtime that don't exist yet, just the current ones. So when I build a .exe and give it to someone on the same OS they can run it.
Fair play, now I know. The hand waving wild-eyed long-haired conspiracy theorist in me has been silenced .. for now :)
AlarmMon Wants To Help You Wake Up In A Unique Way
> Also, a dark cynical part of me wants to ask exactly what the business model behind "free" SSL certs is? You're not paying them, someone else is?

Well, you never give them your private key, so… what could they possibly do??
What a fascinating convergence of math, music and Python. Many people I meet who don't specialize in math but have taken university-level courses in it seem to remember the Fourier transform as a highlight, probably because of its many applications.
They are effectively solar powered, since they rely on a temperature difference.
I would think zero is not good, but of course it's subjective. I like my toast crispy, but soft enough that it's not like a crouton.
PopcornTime final destination
> The Mozilla CA policy does not include a provision for obvious trolling and posturing. If Starcom were to be forced to revoke your certificate for free, why would anyone else (on any CA) ever pay for revocation?

This is not your garden variety, "I screwed up my .htaccess file and accidentally leaked my private key to the world" situation. This is a special case, and some special case rules would be really appreciated by this one, at least.
I may be wrong here, but isn't implicit tag closing consequence of html deriving from sgml? mandatory tag closing is something that came with xml AFAIK
Just curious: how is FreeBSD's development process founded, in comparison?

...I know software quality is in no way proportional to investment, but the fact that there is so little money invested in OpenBSD's development might alone be a reason for a company not to use it, despite some known qualities! (I know, some will say that by this reasoning we'd all use Microsoft products instead, but if you calculate the money + man hours invested in Linux for example, you'd probably have a figure in the tens of millions or more likely hundreds of millions of $...)
39% of Film Industry Professionals are Movie and TV Show Pirates
Ask HN: Can Bitcoin mining fund OpenSSL?
Is it feasible to add crypto-currency mining to open source projects like OpenSSL as a way to generate donations? If everyone running the libraries are prepared to have it run a few single digit %'s slower and allocate those cycles to mining it could perhaps solve the funding problem. I would personally be happy to have my OpenSSL run 5% slower if I know the project is getting funded because of it. Are there ways to get past the security concerns? Could this be practically implemented?

Competing with ASICs is probably not practical for SHA hashes (i.e. Bitcoin) but it seems feasible to target scrypt based currencies like Litecoin or Dogecoin where CPUs are relatively stronger.
Have a look at the paragraph (and list) section(s) of:

http://www.w3.org/MarkUp/draft-ietf-iiir-html-01.txt

P: Paragraph mark

The empty P element indicates a paragraph break.
The exact rendering of this (indentation,
leading, etc) is not defined here, and may be a
function of other tags, style sheets etc.

To whit, the well-formed, "good" example:

<h1>What to do</h1>
This is a one paragraph.< p >This is a second.
< P >
This is a third.

Yes, with spaces and alternating case. This was the standard before
IE6 came out, so it's not that crazy that they closed up some bold and
italics tags -- I'm not entirely sure if there were (are?) any other
SGML dialects that were quite as loosely defined as early "HTML" was.

I think IE6 did a lot of awful things, but the only real "damage" done
was in borking the CSS implementation (especially the box model). The
fact that it rendered crap HTML sort-of-ok wasn't all that bad.

It was the crazy things it did with, lets say.... specially crafted
HTML that led to a lot of problems. And MS FrontPage's insisting on
adding COLOUR="#000000" (black) to all documents, and assuming
BACKGROUND was set to white did a lot to break semantic mark-up.
Awesome work, thanks for sharing that link ♥
You can't recover keys with known plaintext attacks in most encryption algorithms used nowadays, plus, as far as I know, they don't even use the private key to encrypt your request. They only use it for a DH handshake, which establishes the session key you are going to use.
Samsung Galaxy S5 Price in Nigeria
True, but all that violating that policy does is get them kicked out of Mozilla-operated software (at least directly; indirectly I suspect it causes a lot more hassle for them). Their internal rules say that a certificate revocation requires payment so, by their own rules, they are correct. If Mozilla comes down on them for their rules, StartCom may choose to modify those rules at their option.
When glibc guys changed memcpy implementation which changed its undefined behavior, it broke Flash Player and Linus got pissed off. Afair they reverted the change.

https://bugzilla.redhat.com/show_bug.cgi?id=638477#c129
An interesting idea, I doubt an established project with all the personalities involved would adopt it easily - but certainly an idea for a new project that doesn't want to be ad or donation independent.
s3.amazonaws.com certificate revoked
Is there a specific reason to license it for "free" or is there something more to it than meets the eye?
Add in the insight that the project was launched in 2012, and the erection itself apparently takes four people a week[1] and you have to wonder why they're so unambitious. I'd speculate that might be down to it requiring very specific local condensation conditions to function with the claimed efficiency, but there's a long and mostly disappointing history of trying to create drinking water from air[2]

[1]http://inhabitat.com/nature-inspired-warkawater-towers-use-c...

[2]https://en.wikipedia.org/wiki/Air_well_%28condenser%29
Chrome can't connect. TextMate can't update. OSX says cert was revoked.
StartSSL is based in Isreal. They are hungry for money.
sudo apt-get install popularity-contest

results are hosted at http://popcon.debian.org/
No, they are evil because they are lying to me.

When Mozilla put them in my browser, they promised “we will make sure that only people who own the domains get certs for them”. Now there are a bunch of people with leaked private keys and StartSSL is apparently doing nothing about them.

Note that I don’t care what StartSSL wants their “customers” to do, nor do I care what these “customers” want StartSSL to do, but I do care about private keys with associated valid StartSSL certificates floating around the internet, and it is not the responsibility of the owners of these keys to revoke the certs ASAP but StartSSL’s. Given that they don’t seem willing to do so, I’ll have to remove their CA from my browser.

One easy way out for “free certs” would be a clause like “If we have reasonable evidence that your certificate is compromised, we will revoke it immediately and you agree to pay a handling fee of 25 € for that.” in their Terms and Conditions. If such a clause would be illegal, I guess free certificates are just not feasible.