skysight-inc/HackerNews huggingface dataset:
It is the application author's fault but it becomes the customer's problem. This is what Raymond repeats over and over. And just telling the authors to fix their problems is no solution either because they are sometimes long out of business but companies still love to use the software that JustWorks™ even though it is 20 years old.
> I'd hoped that language features like the typestate stuff that used to be in Rust would someday make the work required to use sound analysis tools in production code smaller. I'm not sure if much thought has been given to what kinds of accommodations languages could give to ease static analysis while still being programmer friendly.

Well, since the Rust borrow check is basically a static analysis that's always on and is required to pass for the compiler to emit code, we've put a lot of thought into how to make it as programmer friendly as possible. The final trick that seemed to got it to fall into place was restricting data to only one mutable reference at all times—this was a restriction that's easy enough to understand and can be readily explained through error messages and tutorials. There's still a learning curve, of course, but I think we've got the system down to a reasonable level.
The discussion in the comments is interesting. MinGW, the compiler for VLC, LibreOffice and most other FOSS projects on Windows does exactly what Raymond says not to do. In fact, the entire purpose of MinGW is to make GCC able to target msvcrt.dll. Developers and users love this, since they don't have to distribute and install the CRT with the program. Developers following the GPL aren't even allowed to distribute the CRT with their program, so they have to use one already present on the system.

Though Raymond is correct. The MinGW guys should probably "write and ship their own runtime library," or at least use the msvcrt from ReactOS or Wine. That should make it possible to statically link to it.

Having said that, Microsoft probably won't change their msvcrt.dll in a way that breaks MinGW software, since their users will complain that they broke VLC.
I am very concerned about what will become of the archives. A lot of articles stored by NTIS are not easily available on the internet. Some of those articles were produced by old disbanded research offices of the U.S. Government (and they were really good articles). However, my mind cannot recall what offices they were and what papers they had produced to be able to give you a proper example.
Are you sure about this? My reading of this document is that they do collect and process taxes in most jurisdictions:

https://support.google.com/googleplay/android-developer/answ...
Hubris is ugly.
Robbery is an excellent way to get yourself shot here in NH. I'm just saying...
Not to mention all the other older programs that was compiled with VC4/5/6.
FWIW, in Japan you just get a spousal visa that's valid for 3 years (give or take). After that you can apply for a renewal. You can apply for a permanent visa after 5 years or so but there's no guarantee you'll get it.
So that means they can use the tech, but not redistribute it to anyone else? Sounds pretty fair to me.
That is a different question. The title as you edited it is Illinois Gov't: Don't Worry, We Never Used SSL To Begin With

which is very different (and wrong), from Illinois Gov't: Don't Worry, We Never Used OpenSSL To Begin With.
Is there a correlation now between intelligence and having children?
The review is fantastic. From a quick skim it is spot on in every point - I can detect far fewer factual errors in the review than in the hype about Lewis's book.
Not quite. Every straight matrilineal chain goes back to her. So other female from that time has surviving mitochondria. But many have plenty of descendents through chains of descent that include having a son at some point.
Because HN readers only drink Pliny the Elder and mentioning any other beer is down vote criteria.
Oh, the conundrum that is the very technical HN story. Do I dive in and devote the time to learn whether this is paper is as interesting as it seems on the surface, or do I wait for some explanatory posts or even a TL;DR summary to help me decide?

Edit: The paper helpfully provides much of this itself, with boxed section footers with the change from then to now in how that component is handled. It makes for an interesting way to skim and zero in on sections you may find of interest.

e.g. 4.2 Lazy scheduling ends with *Replaced: Lazy scheduling by Benno scheduling"
A simnple number scroller module in JavaScript
"First come first served" isn't a great way to distribute limited resources, but I don't see how "serve the richest first" is better, socially speaking.
> so every other female from that time didn't have any descendants alive today either...

No, plenty of other females from that time probably have lots of descendants alive today. The difference is the Mitochondrial Eve is the ancestor of every living human today.
Use voice cloaking; I think that will mitigate people's biggest fear of having to put yourself out there and risking humiliation at the same time.
My NDA prevents me from discussing pricing. If you look up my resume and do some sleuthing, you can probably piece together the details of where to go for it.
I think someone else found that, although he linked to their pic.

Remember, lots of people are pushing up bogus stuff into the heap, so just because you see something there doesn't mean Cloudflare leaked it.
"We rebooted the server at 3:08PST, which may have contributed to the key being available in memory, but we can’t be certain.". https://www.cloudflarechallenge.com/heartbleed

That doesn't make sense to me, seems like the key needs to be in memory all the time, or at least during every session.
https://www.dropbox.com/s/ub6wj1aso2mog1y/IMG_0002_.JPG
Big investors = agents of little guys + rich people.

Little investors = all little guys.

Lewis is shilling for a group which is disproportionately not the little guy.

Further, skewing the market in favor of the big guy is just a way to ensure that the big guys can rip off the little guy. Once the little guy is forced to subsidize liquidity for the big guys (as Lewis wants), he might as well just pay a mutual fund the 50bps management fee rather than managing his own 401k.
The technology has existed for so long but never really went anywhere. After half a century there are 30km in Shanghai, that’s all.

Maybe it will work out better in the future.

The biggest problem I see is that the gains of this technology would be rather small anywhere with conventional high-speed rail or existing infrastructure that can be upgraded to that. With Maglev everything needs to be built from scratch. That’s just not very attractive for any place that has consistently expanded its rail network ever since the height of the industrial revolution.

And for what? A 180km/h faster train? I personally very much want that, sure, but is it worth it for anyone building it? I’m pretty sure I know the answer in Western Europe (though I can always hope that maglev has a future there), I’m not so sure when it comes to the US.
The way to read papers: Read the abstract, if still interested read the conclusion, if still interested read the rest.
Public transportation, biking, and dense, walkable cities.

Obviously I'm not saying that the speed should be 20mph everywhere. I'm talking about dense, residential areas, such as New York City.
> and your application's installer installs the redistributable DLL for that version

I don't want an installer, nor to include the redistributable which is around 2 orders of magnitude larger than the application itself! I want a single tiny binary, just download and run on any system, and that's what using MSVCRT allows.
Following seems to be the link to the home page, with credit to the author, links to Spanish and Japanese translations, the package, etc.

http://cheatsheet.codeslower.com/
To me, that doesn't fit with "fully supports our commitments." "Supports" means approval, not just duty. Perhaps I'm reading too much into the language.
Probably Fire OS.
Just a quick confirmation, this applies to Green Cards only, and not H1Bs, right?
If the NEC could do 200MPH consistently Boston-NYC-DC ... that would be huge. Boston to NYC in 1 hour and Boston to DC in 2 hours would be amazing and would be far faster than airport or vehicle travel.
The northeast is as dense as western Europe.
Yes, but if you read the original article [1], they discuss the fact that on Apache servers it is much easier to bleed the key if you manage to make the first request to a newly-started server, because Apache moves the key through some temporary structures early on that then get freed, and after a few requests the freed memory is overwritten. I think they're speculating that a similar thing might occur in nginx.

[1] https://blog.cloudflare.com/answering-the-critical-question-...
That's besides the point. It still costs money, and the company that's vulnerable is not the one paying it. A service like this would be time consuming (bogus reports, etc), and the EFF would still have to use money from donations to finance this.

The only thing I can think about is some security firm doing this, using the exposure as a marketing tool and establish them as an authority on the subject.
This is going to be even more true for me in the future, and I was already pretty intolerant in this respect. I just used LastPass to get a list of all the passwords I should change after Heartbleed, and the list is terrifying - I can't believe how many things I've had to sign up for. My bar for getting any sort of credentials from me has just gone way up.
That's probably good in general, I'm not sure how well it holds up to a survey such as this. The paper helpfully assists in this respect though, as I outlined in my edit above.
I was unaware that this was even in question. Didn't the heartbleed.com security researchers already demonstrate this in the lab?
That was my plan of attack, I left my machine at home sniffing, wonder if I caught it.

Had bleed running in a while loop with no sleep and ab running on a loop as well sending connections to the server hoping to get the mem jostled around enough to cause something like that you described.

I was unsuccessful as of 9:30AM... now I'm really curious to get home and see if I actually caught it... even though I already missed the $10k boat :(
Heartbleed certificate revocation tsunami yet to arrive
5 Steps to Facebook Native Advertising 
Tapping into a new yet old way of advertising, conducted some split tests and recorded the strategy that seems to work the best.

Let me know what you guys think...

Looking forward to your feed back
This article is a PDF document. Here's the abstract:

The L4 microkernel has undergone 20 years of use and
evolution. It has an active user and developer community,
and there are commercial versions which are deployed
on a large scale and in safety-critical systems.
In this paper we examine the lessons learnt in those 20
years about microkernel design and implementation. We
revisit the L4 design papers, and examine the evolution
of design and implementation from the original L4 to the
latest generation of L4 kernels, especially seL4, which
has pushed the L4 model furthest and was the first OS
kernel to undergo a complete formal verification of its
implementation as well as a sound analysis of worst-case
execution times. We demonstrate that while much has
changed, the fundamental principles of minimality and
high IPC performance remain the main drivers of design
and implementation decisions.
Yes! Battery life is a killer feature for me. I'd be willing to sacrifice a lot of functionality for something that was as hardy and needed as little recharging as my kindle.
Your first idea was done before and FB shut it down http://techcrunch.com/2011/05/11/miss-being-able-to-comment-...
http://techcrunch.com/2012/04/03/facebook-threatens-to-sue-t...
I suggest you re-read what I wrote.
Died at 32. What a tragedy.

Googling around indicates he died suddenly of pneumonia-like symptoms. He was working with chemicals whose fumes could have caused that (HCL, e.g.).
This is frequently done in large corporations too - divisions which don't directly serve customers, but instead provide enabling services to other divisions, make "internal accounting" charges against the budgets of the divisions they serve.

This is useful, in that it can let a support service (like, say, IT) prove its use in the regular way that businesses do (profitability). It also keeps other divisions from treating internal resources that are costly to maintain and provide as "free" - if they can find the same service outside of the organization for cheaper (i.e. in this case through Google), they have an incentive to use it.

The issue here seems to be that the NTIS is unprofitable, and it's not actually essential to the functioning of any other parts of the federal government.

tl;dr: Large organizations usually work in practice as a cluster of smaller organizations participating in a free market.
There's A 'Let Me Google That For You' Bill
The bill specifically points out that Google generally points to the originating agency of the reports in question. That is, the NSIT was originally supposed to let the Department of Commerce find Department of Agriculture datasets, but now the DoA just publishes those on its own website and the DoC can just cut out the middleman.
> Having 2k to blow on something like this

If this is as trivial as you're making it out to be then why is this story worth reading and discussing?
It probably took longer to compose that blog post than it took @indutny to disprove it.
Extensive previous discussion:

https://news.ycombinator.com/item?id=7515393
When you search through Google Scholar, the quality of the information you get is actually really good. IMHO the best solution is to get rid of NTIS' goal to be profitable, and simply make it an agency that collects and distributes those documents for free. Integration with Google Scholar would be a logical next step.
Thank you for this, read through the first half of the page and didn't get it. Funny how I can read code but can't read politics.
South Africa Govt. Website Hacked by Maroc Electronic Army
Google’s Production Servers Compromised by Security Researchers
I lived in Mexico a long time ago and recently got back in contact with a friend from there over Skype. We've chatted a few times using video chat in Skype and it was a really good way to get back into practicing Spanish.

I think it you were going to do this on a bigger scale you'd need to have specific lesson plans and conversation topics as well as tips for both the native and learning speakers. For example, tell learner how to ask how to properly phrase a sentence.

Another idea is to have the people on both ends learning each other's language, so rather than teacher-student, both are students, one learning Spanish and the other learning English, for example.
It seems that someone is doing some requests with RSA keys as a parameter.
It doesn't make sense at all to me doing such request in order to get the server private key.
Anyone seeing the same?
Gigabit Wireless Communication Look To Keep Pace With Data Demand
The density isn't really the issue, it's that high-speed rolling stock is simply too good for the massive investment to replace it to be worth it.

In the US, the railway system was developed for freight primarily, and is not suitable for high-speed rail. So, if you want faster trains, you have to lay new track regardless. In that situation, maglev is not necessarily a terrible choice.
Or even the Taiheiyo belt in Japan https://en.wikipedia.org/wiki/Taiheiy%C5%8D_Belt
So @indutny sent at least 2.5 million requests, should we start to think more on the practical prevention techniques?
Looks reasonably active[1]

[1]http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/
Oh, I see you edited your earlier comment. In any case your edited version is still not supported by Apple's slide.
you are underestimating the severity of the bug. The bug leaks server memory - in which case unencrypted passwords are being sent to the server by the user's browser in order to be hashed to be compared to the hashed versions in storage.

Normally this is protected by tls, but as you can see, for servers that suffer from this hole, it's as good as naught.

Note that this occurs for "any" connections hitting the vulnerable server, meaning that the patient attacker can just run this in a script and scoop up passwords, credit card #'s, form information POST'ed in by all users of the web service all day long until the hole is closed. and even then there's a good chance that the private keys were already exposed, in which case the attacker can now masquerade as the server.
I agree, it appears to be well thought out. I have it bookmarked, and will return to it once I finish the book.
Except you can't give security vulnerability details to everybody until you have a patch ready (and I certainly wouldn't argue that you should allow paying for earlier access to the patch). On the other hand, when you have a business relationship with somebody, with non-disclosure agreements in place, you can tell them more details much earlier.
Safari might support WebRTC in the coming months. Apple appointed 4 members to the WebRTC Working Group: http://www.w3.org/2000/09/dbwg/details?group=47318&public=1

Since the signaling is not part of the standard, on purpose, you can choose whatever you like (XMPP, SIP...) or create you own solution.
On the server side, TURN is implemented to go through the NATs, the firewalls, that helps.
If this was reasonably priced, it would increase travel between those cities by a large amount.
Yes. And I think there's a big market for that.

In places like here in China there is a huge demand for 'language partners'. Mostly Chinese looking for English-speaking people, but a lot of foreigners trying to learn Chinese. And many cases where both want to learn from each other.
IMO, CloudFlare is lame. Kudos to this guy for reminding me just how much so.
i built a plogue bidule patch before melodyne rolled out "dna" and it is extremely difficult to get the optimal fft parameters to get an accurate conversion. i cant imagine an algorithm that would get it right from analyzing the sample would be any less difficult. ableton's and cubase's options are pretty rough too. i am a drummer though, i am just trying to make up for my ears.
When the orders were added, there was a modification to the FIX specification for the exchange. For example: http://www.directedge.com/Portals/0/docs/Direct%20Edge%20Nex.... It is everyone who trades on that exchange's responsibility to stay up to date with what's available, and how it interacts with their trading strategy.

"concealed", in this context, just means "too lazy to carefully read the documentation".
For a pseudo-scientific analysis ... it's a shame the units of measurement weren't defined up front.

(I live in one of the 190+ countries that use Celsius, but I know that 99.8% of things on the Internets are written by people from just one of those three other countries that doesn't. I'm also aware that for reasons that are a bit bewildering, everyone in those 190+ countries politely goes out of their way to make it clear that we're talking metric, because we're now used to the idea that if people don't mention units then they're probably from North America, and consequently are almost definitely using gallons (US, not UK gallons), miles (US, not UK miles), Fahrenheit and other deprecated units. We should probably stop being so considerate.)
> If the Crimeans had voted no, would Russia still be there?

Seriously?

Do you actually believe that, or are you simply posting here as part of your job?

You have absolutely no clue as to what a free election is if you believe that 97% of the people in Crimea voted to join Russia. I won't even bother posting any details as to the wording of the ballot, or as to all the Russian slanted propaganda prior to the vote. 97% votes only happen in "People's Republics".

Putin and his kleptocrat buddies (nee oligarchs) are busy looting Russia. Hope you're getting your share.
Followed up with an NDA with an indemnity clause.
For all we know, the morphological differences could have rendered them severely autistic. Isn't it about quality, not quantity?
Or, it could mean you're just be pedantic.
cottonseed -- do you have a dummy email address at which I can contact you? I work for a startup that leverages topology for data analysis, and we are hiring.
Bitcoin Mining Boom Sputters as Prospectors Face Losses
Agree. What a disappointment that was. I ditched it for an iPad and never looked back. The iPad was a revelation compared to the Kindle Fire.
WebRTC Update 2014 by Sam Dutton, Justin Uberti, and Serge Lachapelle
sounds unoptimal
They're doing it to troll you (or others looking for keys).
This is why HTML5 will win in the end. In a few years all your apps will be web-views again. Proprietary, walled-garden standards don't scale horizontally across platforms.
Klee, EXE, Forensic, cbmc, BAP all mix symbolic analysis with SAT solvers into the C parse tree, and can come up with input to contradict the assertions. (automatic testcases or exploits)
Frama-C still beats all with it's interface, but Forensic is so nice that it even tells how the fix should look like.

https://en.wikipedia.org/wiki/Model_checking
None of those will exceed 20mph - public transportation and biking (presumably) follow the speed limit and the average human running speed is 5 to 8 mph. Unless it's a subway or a train.
Looks pretty screwed up for me. I'm on latest Chrome, OSX 10.9.2.

Attached a gif so you can see: http://imgur.com/G6VZP8X
Based on the article talking about ambient temp being 24 I'm going to guess that not everyone in those countries goes out of their way to make it clear that they are talking about metric
Apologies for not thinking of this, fixed now, thanks :-)
44% of Twitter Users are Never Sent a Tweet
Frama-C does not say much, when do don't tell it what it should do. It needs to reason over symbolic facts, C code is not enough. It's not just another simple static code checker.

You can look at the Frama-C blog what it does with a major openssl competitor, polarssl. http://blog.frama-c.com/
Someone is submitting false keys in their POST data :D

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAwYUYN1fR2/z+Net8DdDhNR7poeX608gwFNDVTQZNjldwi503
cLCaFbPpGkkh84sxpsL0PqrMx9OprdNaMPe0ewuTjjZyb1MaqzfXz/XCiOaT7kWZ
P9bRae2cI5CETZHD/CvWjsxZ+0exFRSGtph+3esDuvwGQprfYY8d2PIpPOFDgIW7
gCX6/xTpB+3PCt8lQYbrYiOIogrI+1xpqp5WBCHRzL6La/Zhav1Q6rrSHk1woGdk
gJBNr3k8NsOjFfNbJgLTgsOz7Yu7Wh6UiV7Y5BMxzuK0eMlJey9ODkyFwhG/pnMg
qeMf4j1bfaA9AdI8sffSd+1hY9tbt4vfZhBphQIDAQABAoIBACGh/glwS9rN52h7
mr3T9bADxVsL20H/YsvbV5bhZ407iSXalw4Qw1bOQ877stje8iwnaceSa7C3CqBZ
QS2Nf2J7KpPmxpCugs4LEIjmD383g7I/iljb/t1IHIDZ1wScNtGW1N1QirrvRMmD
Hb6SVko/VBClSHk+7V/JPci8nYok1vWytXyi/QJ8EaQ5FPglm3n+QHBnFdl3A8qn
cWpK3t6BYijkJAK5PNIc1g0YxkSerG5hwCqWleRt29V5QPZqgEc0raSFolN0XOo6
8us1z37IDRGvm0sHbGgKfi3/Mj+b3Npa+0cQgsGVmymLjyMSf/cLiF0c3rDpHamY
NqsFj8ECgYEA4JHeIM0M/MVCbUaqCFOtGYmRK9CL8eoAGVJgXa96Z+gP7W/bAjw9
IEe9NeGIwr2KidZljyv23CwK1Fn7nDuloG5ZXvzpP3jNRJ62Z0Y6RkICpWgpN1HL
uUG6R4LlB3mXyYE4UGoNAxfgWRcPAn0vsKIuY5/N69FBXiE9h6cjHVkCgYEA3Jq8
v/qx7T73p9iUFAFDUNF/poQShqimGdfubMSbhUBXGkx5hPyKYUrzUwwZTlLwo4SB
+nP1cuJUdnEY+ZlzSxvh/EADvxiq20aUm7R+o+GXc68JZBmUKg+tQVSTw+Us8uds
w1jhFa+b4UpSR+ZHOhR5Hhiw1mdRPu5TAwdtzA0CgYBJpQxnTVdY/YePNoFEQcye
d1K4P6flKYvmwfEASC+oK54ti2UTEpYpI92U8eVbl7T7Bug/T3ehNIBIq0msLpNe
TVHZqK8FNaR7QGEo9QrfR35+p+38SkK4+ikQkohxLxrr5giFtoGV5hqYnMs7Ubp1
/nmgCiQJlZIOQHBhMBp/4QKBgEog3OgNz5gPHp0SE8AdJIeVvjUwECGbriTlAEMg
VboTArHdnL/pNH649sajPCWrjR0FO7/zEzlFgGhEXMYSoEFO30MqJ5ghK9h/ARTJ
M/zRo1jGKnuudLElj2xyhSzAZ7g/t7Z0uT3WQqUTmk56vNhxZLmORm3lTdG9t7s+
1dBJAoGBAJWKz/T/0PQLOOggof0KzEciehWuLcV0eLid16DaNWwiVkm88zt54MdB
FkbsXWJpQxYpKCxt4XaZGBVP5yLIkrWjElWMtrZPh3pYR8WJQTwosv74n7roBt80
9ejTR8GQ7401BS7foMjCnVevrl2UwN5SPvtYsLLEMxYGGgSwfz9D
-----END RSA PRIVATE KEY-----
I stand corrected. My lessor points on only the authentication portion of the site don't justify the title, that I would correct if I could. Thanks, let's let this go the way of the Boskop...