skysight-inc/HackerNews huggingface dataset:
Was "128 GB" a typo for "128 TB"?

Incidentally, the mechanism for sharing the pad doesn't have to be 100% secure, as long as you can reliably detect any compromises. If someone opens the briefcase while it's in transit, you just generate new pads and send another briefcase. To compromise the system, an adversary has to compromise the pad in transit without being detected.
We have now deployed new keys and certificates across our network after patching the vulnerability immediately this morning. Forward secrecy was used previously and still is, drastically limiting the surface area/usability of the attack in our case.

You can view stackoverflow.com's current public SSL test here: https://www.ssllabs.com/ssltest/analyze.html?d=stackoverflow...

Nick Craver
Stack Exchange Systems Administrator
Thank god I'm using Keepass I can put my head on the pillow comfortably.
OpenSSL Heartbleed Security Update
Hi Peter,

The point of the article was more saying that revoking certs is not sufficient, and we need better procedures in place to prevent disaster when problems of this nature occur.
That may be true in for a single founder at the bootstrap phase. For a company where the founder/boss doesn't directly make all the decisions finding, negotiating, getting approval and avoiding the many pitfalls of working with freelancers transaction costs are very high. Interestingly, very large firms can get to the point where inefficiencies from centralization exceed the cost of transactions. IE, armies of "graphic designers" producing a trickle substandard work at massive expense.

I really do suggest you look at Coase' paper. To me, its a great example of what economics can do. It's very accessible. The logic goes:

We know competitive markets are better than centralized ones at a national level. So, why are individual firms so large, centralized and horizontal? Wouldn't Microsoft or Walmart benefit from being many small independent units freely transacting with each other? Why do we even have firms? Why don't individuals just sell their service to each other?

The answer is usually "economies of scale" which is a semi-tautological answer. Why does "scale" need to be achieved by a a firm. A market can have scale too. Horizontal scale (eg a company with its own IT department) actually prevents the usual examples of economies of scale from occurring.

The paper argues (in my opinion very convincingly) that "transaction costs" are the main reason that firms exist. Transaction costs are responsible for horizontal companies. The enormous level of inefficiency caused by the centralization of firms (think East vs West Germany) needs to be offset by even more enormous transaction coss.

One difference that happens when you internalize this point is that you can imagine a lot of slack existing ins systems like this. Hours worked is one example (but not the only one). It's possible that the deliver guy will earn more in fewer hours, Uber will earn more than the parcel deliver companies and parcel delivery will become cheaper and better all drawing from this pool of wasted potential. It's a very big pool.
This site has actually been around for a while. Great Coles Notes for SEO. But if you have the time, watch the full videos from Matt. His advice is required listening.
Looks like he's been getting the kind of exercise I need to make time for:

http://www.mattcutts.com/blog/a-big-challenge-running-a-50-m...
Of course you can -- for example, if you are NSA and in position to apply pressure to whoever hosts lastpass SSL frontends.
And it still relies entirely on the OS's scheduling algorithms for caching and IO. mmap is nice but it has no idea you're running a database.
You're correct. It's not great copy. Also, 'struggling site owners' will not understand these videos. Cut 'struggling' and 'their site' and it becomes:

"...to help site owners understand how Google search works..." or "...to help site owners understand how their decisions affect their Google search results..."
It's because Rails is essentially a "batteries included" full stack framework which helps a startup focus on building a business and not on building technology infrastructure. Outside of Rails and Django, you're left to make a lot of decisions to get the same level of functionality before you can start building even an MVP.

Here's what you get out of the box with Rails:

1) Database schema management via Rails migrations which work great with mature RBMSs like Postgres and MySQL.

2) A solid ORM (ActiveRecord) which makes CRUD super easy and intuitive.

3) An active community with lots of open source libraries (gem) to do just about anything you want.

4) Highly productive ways to work with frontend (CoffeeScript) and backend (routing, controllers, active_record, etc).

5) Great documentation and ecosystem around it.

Contrast this with Go, Node, and other OSS ecosystems and you're often left to make a lot of the decisions on your own with immature libraries. Often to get to the same place, you'll be inventing a lot of your own infrastructure.

Node is probably the closest to approaching a "batteries included" status with the MEAN stack, but it's not quite there yet.

You can certainly get all of what Rails comes with out of the box on any stack, but unless you know it really well, there's a lot of decisions to be made. With a startup, the kind of analysis paralysis that often comes with technology decisions can really kill an idea in its early stages.
Kimono Labs (YC W14) is hiring its first three engineers
You should be able to express your ideas -- with jargon or nerdspeak or technobabble -- in such a way that people can understand you even if they don't understand those words.
HTML5 is a lot more than the new semantic elements.

http://html5test.com/compare/browser/mybrowser/ie-6.html
I use hacker here is a broader sense than someone who writes an app for $platform and names it $-er(terminated with r instead of er).
Already exists. It's called Payroll Tax.
This might seem unrelated, but in the bicycle racing world, most of your high end manufacturers now all make a women's specific model (for differences in body morphology, etc). When they started doing this, some manufacturers went all in, made really great well thought machines for actual racing women. Most though, took their men's model's, shrunk them a size, and painted them pink, purple, baby blue, or put floral print on them. It's a process described as "Shrink and Pink" in a not so positive connotation. It actually seems to HURT sales from ancedata figures gathered from friends who run or work at Bicycle shops in my area. The common opinion is that making something pink or girly colored off puts more women than it draws. In the last 2 years especially, women's manufacturers have responded.. with normal non-pastel colors.
I monkey-patched Math.random() to launch horizontal missiles at the top of the screen and always return 1.

:-)
Ask HN: What customer can do regarding heartbleed bug?
It seems like many sites are affected by heartbleed bug and some quite popular (used as infrastructure) are not yet fixed. And since all these systems are interconnected, security problem in service X might cause problem in service Y even if service Y does not have this issue.

So the question are have the following:

- How serious is this problem?

- What one needs to do to minimize impact on his/her own security?
Oh, this time, the (free)ssl cert provider(s) is/are vulnerable!
3 easy steps to get started with a hypermedia API
Spell Checker in AWK
This does not impact SSH, see http://heartbleed.com/
You're right, thanks. But C-u doesn't seem to be necessary, unless I have a strange setup.
It is as crazy as it sounds because we were talking about implementing an actual language/library, not about doing the linear-algebra equivalent of restating Turing's thesis.

> not the most efficient way to go about it

understatement of the century.
My new favorite gif ;)
King of Lemon Laws files suit against Tesla
It's great to see the Science Gallery get some press! It's an amazing place. One of my best friends from growing up is the current program manager and I always here about the work they do there. For those that don't know, Science Gallery is sort of a museum 2.0, a modern take on a museum. Interactive exhibits that are around for a few months at a time. For those looking for inspiration when it comes to not only teaching the public about science, but getting them to actually care, check it out.
Please support this iOS Application Development Course [Kickstarter]
True, but it's extremely useful when you're terminating SSL on Amazon's Elastic Load Balancer and want to know if they've fixed it yet or not.

Or, another example, when you want to know for sure that you've restarted your webserver and you weren't doing something stupid like running a version of nginx that was statically linked against openssl.
See this > https://en.wikipedia.org/wiki/OVH#WikiLeaks
Well, it's probably a good thing, as otherwise the project would end up with http://en.wikipedia.org/wiki/Design_by_committee

For actual reasons why, I think the biggest reason is that designers don't have any actual power in open source software. They can _ask_ people to implement their changes, but can never do it themselves. And the people they ask care more about solving problems than appealing to the masses.
It's extremely easy to exploit once it is known. The question is simply: Did people know about it and not disclose so they could keep exploiting it?
The 2007 book Rainbows End by Vernor Vinge addresses this topic from a science fiction perspective. A major plot element is the ability of individuals to enter into "affliances": digital, automatically-escrowed contracts between individuals providing small services in networks created on-demand to produce larger-scale goods and services. https://en.wikipedia.org/wiki/Rainbows_End (copied my past comment at https://news.ycombinator.com/item?id=7287584)

Also, here's a related past HN thread: https://news.ycombinator.com/item?id=7287155
Seconded, too. All my domains (httrack.com) have been registered since 2000 with us, and they are totally trustworthy. There are cheapest places, but probably not as safe...
Battery offers 30 second phone charging
I think it's a headline editor feeling just a little too clever. Spine stimulation... 'shocker'... Get it?
Building 2048 in AngularJS
What makes the single producer (writer?) case different from multiple, in the context of the effect on readers?

If there is a single high-volume data pump, for example machine generated data, will readers be affected by a continuous "fire hose" of incoming data?
I wish we could retrieve the solution we used for past levels. :(

Okay, I think I've replicated it. I just overrode onCollision with empty braces, so the final definition looked like this:

map.defineObject('attackDrone', {
'type': 'dynamic',
'symbol': 'd',
'color': 'red',
'onCollision': function (player) {
player.killedBy('an attack drone');
},
'behavior': function (me) {
},
'onCollision': function (player) {
}
});

Note that you're closing the game's braces, inserting another definition, then re-opening braces to match the game's closing ones.
> The problem with C is that a lot of people don't write it well.

Including people responsible for one of the most important security-related library in the world. No matter how good and careful a programmer is, they are still human and prone to errors. Why not put every chance on our side and use languages (e.g. Rust, Ada, ATS, etc.) that make entire classes of errors impossible? They won't fix all problems, and definitely not those associated with having a bad code base, but it'd still be many times better than hoping people don't screw up with pointers lifetime.
I keep trying to imagine developers deliberately breaking their source code to fail in Bill Joy's vi to force users to upgrade to vim.

IE6 is certainly nowhere near as capable as modern browser but if you don't need fancy HTML and whamodyne JS then maybe it's not such a handicap after all?
The plan is to provide primitive data type extensions as well which can be used in place of the "var" keyword
Design doesn't "scratch an itch" in nearly the same way. Also, it's less reusable; many developers are allowed to work on their project as it's useful to their employer.
I think this is talking about immediate ROI, that is customers that actively purchase products, and indirect ROI, or customers that serve some other valuable purpose.

As most sites follow some kind of 80/20 rule, be careful to dismiss a small percentage of users if they fall in the critical 20%.

Then again, if you have data that shows IE6 users are just parasites, get rid of them.
It's as if Robin Van Persie and Will McKenzie (Simon Bird) had a baby.
Wow, great. I had noticed but didn't think you could do that!!
Could you explain how you would do this?
There doesn't seem to be an editable line, what's the trick?
I'm in the West looking out..
> hover around 3-5% (IE6,7,8 combined)

I do not see the point of worrying about this. If enterprise (put forward as the major user of these) is the worry then you might have to care. If it's random users that just don't feel like running Windows Update, well, these people aren't going to be spending much money anyway.

Worrying about [insert version of IE here] hanging around forever seems to be nothing but complaining for the sake of complaining now that IE6 is completely out of the picture.
The main reason I use MongoDB on Node is the maturity of the Mongoose ORM - I've used Node-ORM 2, BookshelfJS, and SequelizeJS and none of them felt as mature as Mongoose.
There are services that do something like this. Mark Monitor springs to mind as one of the major ones, with a lot of complimentary services too: https://www.markmonitor.com/services/domain-management.php

I doubt they are cheap. I'm sure others HNers could weigh in with alternatives.
Also, the NIC in Libya threatened several times claiming that .ly domains had to fall within Sharia. I can guarantee that most bit.ly URLs rarely fell under that requirement.
To me, it means the person will run operations for the firm, that the person will be the operational leadership for the company.

That could be scary for someone who doesn't want that kind of responsibility, but then those are the very people you don't want to talk to anyway.
Nit: I would consider one time pad to be a method of encryption.

Ah, true. But the encryption algorithm is much simpler to implement than most :-)
Hah. Turns out you made a minimum viable product instead of a joke. I say roll with it and see if it's profitable.
It may be legal, but the "contempt of court" ruling that will inevitably and immediately follow is also legal.
What the "Heartbleed" Security Bug Means For You
I got contacted by Heroku 1h ago to reissue certificate and update my SSL endpoint.
I think it is important that the hardware is based on a big opensource platform – it means you are never going to have an expensive paperweight. With the software it is transitioning to use standard programming languages – so you get the full hackability of those later on.
If there was sufficient demand from users then the software could be open sourced – definitely intend for people to be able to create their own programs and share them.
The "known vulnerability window" is over 2 years.
Love innovation in this area and will play with this a bit. HNers interested in this might find happiness with Snipcart (https://snipcart.com/)
Actually Windows XP is 29% (http://www.networkworld.com/community/blog/end-windows-xp-ha...) though it is steadily dropping.
Here's the problem with an "internet of things" future
Imgur and Craigslist specifically scrub EXIF metadata (EDIT thanks to /u/user24) for privacy.
I suppose you could carry it on a usb drive.
Prototypo – Streamlining font creation
Why can't we write a super hack-ass extension for Chrome that emulates IE6, warts and all? Then just src it.
This is great! Does anyone know if something similar exists for Ember?
What's the point of plastic banknotes?
In case it is useful to anyone: here's my notes on rebuilding RPMs for Fedora 18: https://gist.github.com/dahjelle/10151097
"If we expand the definition of "encryption scheme" sufficiently to allow transmission of secrets outside of cryptographic channels, then OTP is not even close to the only unbreakable system."

Any scheme which allows sharing arbitrary amounts of random information is less than or equally secure as an OTP (security defined per symbol) since OTP reveals no information per symbol; also, it uses the minimum amount shared information to do so, provided your symbols are equiprobable.
The Qualys SSL Lab server test is also checking for Heartbleed now:

https://www.ssllabs.com/ssltest/index.html
Yes, I'd say most MITM scenarios are at the client end.

But you could, for example, be an evil network admin near the LastPass servers. That would let you MITM almost everyone who connects.
I don't get how this works. Is it letting the nerves communicate across the severed area?
Wow, just piping the output from this proof of concept python script through grep and searching for the string "pass" shows that on a number of sites that are vulnerable it is that easy to pull a logged in user's username and password.

Scary...
Here's a direct link to the journal article PDF. You probably need institutional access for the link to work:

http://brain.oxfordjournals.org/content/early/2014/04/07/bra...
This singular, provable fact is the basis of the modern Internet.

...we're not on the modern Internet. I'm looking forward to it; it'll be a better place.
Isn't Shopify mostly targeting people who want to sell multiple items via a shopping cart and/or host their product website at Shopify?
Stop Motion Music Video – Upper Case Disaster
True, although if nothing a discrete “You want full staffing ready for something bad next week” would have been polite.

The bigger question, though, is how much trust you can have with the kind of people who would zero-day most of the internet for a marketing exercise. Discrete notifications would have closed the vulnerability window for a lot of people (think e.g. stealthy AWS, Rackspace, etc. upgrades) and it's not clear to me that Codenomicon is likely to produce future tips of such value as to outweigh that.
Build 2014: A very different Microsoft takes aim at the future
The problem, and I think this may have been touch on somewhere else in the thread, is that C++ can be really complex to wrap. So embedding a C++ library in another, higher-level language can be very tricky. It often requires wrapping the parts of the API you want to use in C.

I'm fine with low-level libraries being written in C++, but would hope that developers expose a C API around everything.
This was actually broken in practice once, by (you guessed it) NSA. They managed to break into part of Soviet VENONA since the demand of OTP keymat during WWII was such that someone took a shortcut and reprinted pages of random numbers.

Don't ask me how Cold War-era NSA discovered that without Cray supercomputers everywhere, but even this scheme is difficult to pull off in practice.
Yes, that is exactly what I was thinking of. Thanks for the link. The discussion I was recalling is here

https://news.ycombinator.com/item?id=7282005

but the thread is a lot heftier now.
- for privacy
Networking for Capital: advice for entrepreneurs getting started in tech
How exactly does the OpenSSL TLS heartbeat (Heartbleed) exploit work?
Do you prefer to work for socially conscientious employers?

Sure. But there's always the competing option of "work for a socially ambivalent megacorp which pays more, then donate the delta to your cause of choice." Or more commonly, "I have three kids and medical bills, and am not free to arbitrarily take substantial pay cuts."
Thank you. That makes more sense now.

I'm guessing that tons of people will run into this. I bet a blog post would get you some traffic... :)
This article mentioned that as well. I mean a basic drive for humans is sex - but walking, not so much. The movie "The Sessions" talks about the importance of sexual function for a immobilized man and is well worth watching.
It's not dead the same way as Mosaic isn't dead. Meaning there is absolutely no reason to care whether anyone is using it or not when you develop some site. If they open that site in old IE - it's their problem.
Square Cash introduces Activity View
Everyone who they were MITMing. I thought that was implied in the context.
How do I embed your Haskell library in my Lisp program? This is where C shines...it can be used everywhere, including embedded in other programs, now matter what language it's in.
I'm currently working in a very heavy enterprise space, most fortune 100 banking/insurance, etc. companies use our software. Our requirements are only IE9+. I'd be scared of the legacy companies that need older support
IMO unless you desperately need one of the new features I would hold off a few weeks. With a release this big I'd expect there will be some bugs and wouldn't be surprised to see 2.6.1 shortly.
Well, the title says you play the game by modifying the game's source. Turns out you don't modify the game's source, you modify specific snippets of code that are provided on the page.

Last weekend I hacked around in the source of various online games, I anticipated this to be a similar experience but was disappointed to find that we weren't supposed to actually change the game's source.
It goes futher than that in OTR. After the ephemeral keys are out of use, the public keys (used for encryption, not decryption) are broadcasted so if later someone gets an old encrypted message, it could "effectively" have be written by anyone.
I mean... the videos are sortable by shirt color. I'm not sure quality is truly the goal here.
Are you referring to selling digital photos? If so, you can sell any kind of file with Snappy Checkout.
He supported legislation that maintained the requirements for a legally-recognized marriage that have been around for as long as this country has legally recognized marriage. It's unfair to describe that as homophobic. We have no idea what his feelings are towards gay people, only that he believes "marriage", in a legal context, should require exactly one party of each sex.

There's been no evidence that this position affected his work at all over the last 15 years, or the ways he may have interacted with LGBT coworkers. There's also no evidence that he fears or hates gay people.

Relationships are a complicated topic, and a lot of very reasonable, intelligent people have a very diverse set of opinions on how they should operate. Can we please stop lynching someone because he happened to hold (at least at the time) the most popular opinion?
Maybe, but you do realize that there are actually a lot of very smart people working on this stuff full time?
thanks! I'll take a look at it.

I use elasticsearch for adhoc querying : http://daemon.co.za/2012/05/elasticsearch-5-minutes/

And couchdb does have atomic in-place updates, http://wiki.apache.org/couchdb/Document_Update_Handlers

I used the latter recently to track the last view-time on images, as well as to build a schema migration routine in like 100 lines of code.

edit fixed link
Define "some". The percentage is very low even at the 5 year mark ;)
Show HN: SnowShoe – Little pieces of plastic with secret digital identities
Windows XP still seems to be Good Enough for the industry titans. (My desktop machine is still XP, due to move to win7 in the next few days, granted, but I'm typing this on XP)
I've had it recommended a few times now. I'll add it onto the pile =)
I don't understand how anyone can throw last pass under the bus here.

0day where an unbelievable amount of sites are affected. last pass comes out and says we were vulnerable and we fixed it and provides information as to what it means for your data... I wish everyone did that...

edit:
A lot of people recommend keepass. keepass is vulnerable to the same thing everyone else is worried last pass was vulnerable to. kee pass' download site is HTTP. You could be getting trojaned binaries and incorrect shasums if you download it from ANYWHERE.