skysight-inc/HackerNews huggingface dataset:
I'd disagree with your disagreement ;-) C++ has constructs that let you build safer and more secure systems while maintaining good performance. You can write high performance systems without ever touching a raw pointer or doing manual memory management which is something that you can't really do in any other language. Yes, you need to trust the underlying library code which is something you have to do for pretty much any other language.

In my experience well written C++ has a lot less security issues vs. similar C code. We've had third party security companies audit our code base so my statement has some anecdotal support in real world systems.
So does fettered capitalism, apparently, just for different constituencies. :-)
Also the library he pointed to has only had 33k downloads total. Can you really suggest that as a replacement for one of the most heavily and read crypto libraries on earth? I wouldn't be surprised if OpenSSL had more than 33k programs that use it as a dependency.
It's interesting how things work out. Since we didn't have the connections at first, we wound up getting our company to the point where we don't NEED venture capital to get to where we want to go. We can get there organically. If we take VC, it will be for a land grab and massive acceleration. So in some ways, things work out just the way they should if you don't go out of your way to chase people.

Kind of like how you get married to the right person if you just keep being yourself.
Then again, you don't need to be the creators of Cocoa Touch to build high-performance iOS apps.
Agreed. Quite interesting. It's often very true in the tech industry as well. I've found that many Alpha personalities will dominate conversations and stifle interaction, which, while sometimes productive (nobody loves a rabbit trail), can also stop potential ideas from surfacing to the top.
It could be some psychological mumbo-jumbo about blowing their load, or it could be that it is actually taking work to prepare the UI toolkit and manufacturing processes needed to make multiple sizes of iPhone.
Isn't this basically the whole point of QuickCheck-like testing frameworks? They're basically a specification that is attempted to be falsified in some way by a fuzzer. I don't see why most C projects couldn't be doing this.
I personally think this is silly.

I agree! Thankfully, that's not actually what Fog Creek does. Let's separate two aspects of this process, because they deserve different treatment:

1. *Going to recruiting sessions.* Going to recruiting sessions
is expensive and time-consuming, as Liz noted. To go to
recruiting sessions, therefore, you have to optimize your bang
for the buck, and *that's* where the selective schools show up:
Fog Creek simply did get a better pool of applications when
going to selective institutions. There are other things that Fog
Creek can do to optimize for candidates who actually build things,
and it turns out they do those things, too (sponsoring intern events,
sponsoring OUTC, and so on). But career fairs at selective schools
can be enormously effective, and are a bit easier to come by.
2. *Evaluating applicants.* When Fog Creek does résumé screening, a
whopping *one out of seven points* is awarded for going to a
selective institution. Everything else--having a portfolio, having
passion, demonstrating follow-through, etc.--has absolutely nothing
to do with where you went to school. And that's *only* used for the
résumé screening. Once you get your foot in the door and talk to
a human, it never comes up ever again, in any context. (When I joined,
Fog Creek even did double-blind interviews to enforce that!)

So yes, only recruiting students at selective schools is stupid. But that's not what Fog Creek does.
>The problem with C is that a lot of people don't write it well.

There are languages that make it very very hard to write bad code. Haskell is a good example of where if your program type-checks, there's a high chance it's probably correct.

C is a language that doesn't offer many advantages but offers very many disadvantages for its weak assurances. Things like the Haskell compiler show that you can get strong typing for free, and there's no longer many excuses to run around with raw pointers except for legacy code.
Unfortunately, if you have been using an AWS ELB to terminate SSL traffic, they are vulnerable to this particular exploit. See this forum post: https://forums.aws.amazon.com/thread.jspa?threadID=149690
Agree but consider this:

If the timing is perfectly tractable the system is gamed. A small amount of noise that prevents manipulation is a good thing over time for the market. It means the stock is going to have less vol which increases the value of the market equity given constant cash flows. That's another policy goal more broadly. That is, if it works this way.
They get $10/stay and the cost to AirBnB is fixed at whatever it costs to run the computer systems.

Effectively, their profit is $10 per stay and their expenses border on $0.

The valuation is a bet on a YouTube exit. Most of YouTube was massive copyright violations (still is) and was a massive bandwidth cost sink (suspect it still is), but since Google bought them out that doesn't matter anymore. In fact, YouTube is a gigantic brake on innovation in the video side of the web precisely because they choke off any useful profitable business models.

Similarly, if AirBnB can get somebody big to buy them out before the lawsuits overrun them, cha-ching, go the owners and initial investors.
That's a difference, but it's a difference with obvious large implications for using the things in performance as well as experiments. As such, it's hard to see how it's a problem in the experimental design; if you're not allowed to adjust the Stradivarius while it's in your possession, maybe a newer model really is the right choice for a concert?
There is another important point of outsourcing. If there is more competition here, in the US, then chances of outsourcing to India, China (where pay is substantially low) will also reduce. That might mean more jobs here, in the US.

Take Cognizant Technology solutions for example. I know a friend who works for the company. They are a US company (NJ based) but the majority of their life-sciences projects are outsourced to India office. They pay my friend one-thirds of what they charge the client for him in the contract. Him and about 5 other people who work here for the client, send work off-shore to India office to about 50 people. This model of outsourcing the majority work to India suits the client because the total costs about one-tenth of what they'd actually pay if everyone of those employees was hired here, in the US.

Not only is this model hurting jobs in the US, it is bad for the employees here well. For my friend, he has to work during the day, and then spend most of the night delegating tasks off-shore. He practically sleeps only over the weekend.

This might be a one-off example with this specific client only for Cognizant but I am aware that the profits from pay-scales are company-wide.
This sounds reasonable enough. But how will I know when to ask a question? It's not just hellbans; it's my understanding that there is no notification when one's account is penalized for some technicality (e.g. deleting a post before posting a dupe).
Thank you for the respectful disagreement (vs. 'smug'.) You make good points and I have some sympathy too - I understand that it's not easy being forced to make a quick and major decision. That being said, you don't always get to set the pace, and being confident in making decisions on the basis of imperfect or incomplete information is a valuable life skill. I can think of no better time to make a low-risk, snap decision about where to spend a few months than in the middle of college.

With regards to the decision around where you might spend months of your life, it's not like the location of the internship was a secret before crazypyro interviewed. The question about whether the company will treat the intern well is more nuanced, and you'd have to go with your gut.

Given the competitive nature of the market for CS interns and the quick decisions needed, the Secretary Problem might offer a good solution for crazypyro and others in that situation.
Not a private company, either. Suffice it to say I was referring to something like a Basecamp-type company.
Really, it's only effective at showing how violins compare when being played by blind musicians in hotel rooms, while being observed by researchers. But at some point you have to stop finding caveats and find some evidence for the contrary position.

What is the contrary position? That older violins have some kind of superior magical design that can't be replicated? Has anyone validated the claims for why these old violins are supposed to be better?
I just added a comment about Cognizant: https://news.ycombinator.com/item?id=7550824

I believe that it is a very unhealthy model that they have.
Does anyone know of a nice way to unlock levels for the mirror?
I'm on the first jQuery one but all I see is black text on a white screen. No players and nothing changes when I use the arrow keys. I can't find anything in the code I can edit either.
I'd like to try the mirror but I don't want to have to play though the whole game again?
Tonx's selection is broader, with 26 shipments a year you get 26 different single origin beans. On Blue Bottle site I chose a subscription for a drip coffee maker and was given a choice of 4 flavors.
Yes, I would put that under the "implications for Bitcoin web services that use HTTPS" category. For context, the deleted question asked about the "Bitcoin blockchain" so I was responding to that specifically, with the added caveat for Bitcoin services that use HTTPS.
I thought it was broken since nothing happened when I clicked. Then I looked again and had a result.

I'm also getting this error:

Error: not well-formed
Source File: http://heartbleed.filippo.io/bleed/foo.com
Line: 1, Column: 1
Source Code:
{"code": 1, "data": ""}
>unlike forums, people really enjoy mailing lists. I don't think I've ever met anyone, ever, who said they liked forums

I bet if you asked people if there were forums they liked, you'd get a different set of responses.

Forums do seem to be generally less popular than they once were, though, probably because a lot of the functionality they used to provide has been folded into social media and blogs with social logins.. just plain forums on their own might seem a bit atavistic to someone who grew up in the age of facebook, youtube and whatever the new thing is i'm too old to even know about.
"Appeal to authority" is a shorthand form. The thing people object to is more formally known as "appeal to false authority" (think "I'm not a doctor, but I play one on TV").
GameSpy and a note on cloud services
The title is misleading. This is not “AWS vulnerability”. What happened was that someone shared his/her admin-level credentials with the world.

Whether credentials are for their AWS account, or Rackspace account, or Azure account, or their personal banking account, makes no difference, it is not “AWS vulnerability” or “Rackspace vulnerability”, or whatever, it is just a big, big, rookie mistake made by the developer.
Have you tried the fingerprint scanner? Why do you say it is 'flimsy'?
SF Survival Guide
Child's toys are usually large and chunky. I recommend not buying an android phone.
I believe Haskell could be up to the job, but I heard that there were some difficulties in guarding against timing attacks. However those could have just been noise. I know that a functional (I believe and haha) operating system was made in Haskell.

Aren't Operating Systems lower level than OpenSSL?
We might be stuck with C for quite a while but then maybe the more interesting question is 'how does this sort of thing get past review?'. It's not hard to imagine how semantic bugs (say, the debian random or even the apple goto bug) can be missed. This one, on the other hand, hits things like 'are the parameters on memcpy sane' or 'is untrusted input sanitized' which you'd think would be on the checklist of a potential reviewer.
Sure. Don't buy e-books from DRM afflicted distributors. There were enough stories that anyone should learn that lesson by now. And that applies to everything, not just e-books.

By buying from them you only help proliferating that sickness.
Ideally, no, but with SSL, and a very-strong password, it might not be worse than other options for automating payouts... until a major bug like this comes along.

For comparison, the Bitcoin RPC password timing bug - https://github.com/bitcoin/bitcoin/issues/2838 - would have been a more slower and blatant/detectable way to compromise the same sorts of bitcoin RPC daemons.
Be that as it may, porting OpenSSL to any other language is Not Recommended. The code is hideous and the documentation is practically non-existent.

The only reason anyone can recommend using OpenSSL is that it's so widely used and battle worn that vulnerabilities are more likely to be patched than in some arbitrary obscure SSL library without all the warts. If it had been published as-is for the first time in 2014 then no one would touch it.

In addition to that, if you're going to create an SSL implementation in a new language, it would be much preferable to do it without the BSD advertising clause, which you're stuck with if you start with OpenSSL.
Next year they should let people apply for the chance to be randomly selected to receive a visa.
Codecademy for R – Interactive learning
Polio Spreads From Syria to Iraq, Causing Worries
I'd shoot Sam or Paul or someone at YC an email explaining that you had to buy your ticket to the Bay in advance, so you're coming whether or not you get into YC, and ask if they can put you in touch with some other 'good to know' people in the bay while your here. I'm sure they'd be happy to help.
OpenSSL and similar libraries spend most of their time processing short packets. For example, encrypting a few hundred bytes using AES these days should take only a few hundred CPU cycles. This means that the overhead of calling the crypto code should be minimal, preferably 0. This is in part what I meant by "first-class". Perhaps I should have written "zero-overhead" instead.

I googled around just now for some benchmarks on the overhead of FFIs. I found this project [1] which measures the FFI overhead of a few popular languages. Java and Go do not look competitive there; Lua came surprisingly on top, probably by inlining the call.

Before you retort with an argument that a few cycles do not matter that much, remember that OpenSSL does not run only in laptops and servers; it runs everywhere. What might be a small speed bump on x86 can be a significant performance problem elsewhere, so this is something that cannot be simply ignored.

[1] https://github.com/dyu/ffi-overhead
Yeah, I had the same issue. A spinning wheel while it's waiting would be helpful.

Other than that, great work @ars!
yes I do. I rip them off the device as soon as they download and store a copy on my PC.
Can you show me what the jQuery level looks like for you? I want to make sure that it's working correctly.
I must say that Cover could go long road to a medium sized company instead of selling. IMO they sold out way to early. The product was great, it looks like they followed Startup spirit and really invested in this. The concept is also pretty nice and they had huge user base. Endless ways to monetize.
Unless they got really good deal this transaction could be premature...
>What is the contrary position? That older violins have some kind of superior magical design that can't be replicated?

Pretty much.
If I recall correctly, almost all the nordic countries accept English to fulfill their language requirements.
Does the mirror [http://alexnisnevich.github.io/untrusted/] work for you?
It's far away, and as a developer I don't think you can earn as much as you would in the US. Certainly to be more HN specific, the startup scene is not much to talk about.
This story is from October 2012. It's not very obvious from the NBC website, but if you follow the link to BoingBoing it is. I seem to remember there had been some change/improvement in Amazon's TOS over this issue sometime in the last 18 months, though I don't recall when exactly so I might be wrong.

I understand old stuff getting posted because many websites recycle non-current stories automatically as 'you might also like...' linkbait, but it is worth checking the date of something before you post.
On a linux box:
[For each set of certs used for each of your public facing sites...]

1. Open a terminal[cd into] /etc/path_to_ssl_certs_folder[per site].

Ex. /etc/ssl/nginx

2. Regen the certs [example nginx mail server]

openssl req -x509 -sha256 -nodes -days 3650 -newkey rsa:4096 -keyout mailkey.pem -out mailcert.pem

[this command generates a private key and server cert and outputs to pem's]
[Note also the key sizes are 4096, you may want 2048. AND I use -sha256, as sha1 is considered too weak nowadays. These certs are valid for 3650 days...10 years]

Since the command overwrites certs/keys in the current directory of the same name as the outfiles...that's it...you're done. Just restart nginx.

If you change a self-signed cert, like above, expect a new warning from the client on the next connection...this is just your new cert being encountered. Click permantly accept..blah blah.

------------------------------------------------------------------------

On a Windows box:

1. open an admin cmd window and run 'mmc'.

2. Add a new snap-in for Certificates as local machine.

3. Find and 'Disable all purposes for this cert'.

4. Import your new certs from your 3rd party or that you rolled yourself from your enterprise CA.

5. Test new cert.

6. Delete old cert.

[If you run your own CA, you should already know what to do...]
That reminds me of this which happened a few years ago:
http://www.theregister.co.uk/2009/07/18/amazon_removes_1984_...
Your employer can also sponsor you for a green card. Source: I'm doing that right now.
I imagine that would not work well for startups, though.
Awesome, thanks for this.

Any chance you would open source this?
I have to wonder if the authors who demanded DRM from Amazon have figured out that this is the kind of behavior that drives people to download books illegally, or if they still fail to see the connection.
You're now just forming an ad hominem by twisting my words. Good for you. I want to live with people with the wherewithal to contribute equitably to the commons of the household in which I live. In my current household, I currently supply most of the common goods (sponges, garbage bags, soap, tools for home improvement, laundry detergent, toilet paper, cleaning supplies, etc.). It gets pretty old after a while when no one else feels the need to contribute equitably. If I left things up to my roommates to take care of things, we'd run out of those basic needs. We are two days away from no toilet paper today and I'm certain that I'm the only one that thought to take care of that. I'm the only one in the house that buys the tools we need to fix things (drills, screwdrivers, pliers, etc.). I would prefer to live with people who, when inconvenienced by something that inconveniences us all, won't hesitate to pony up the cash to resolve it.

Personally, I absolutely despise the situation that exists in the city and thinks everyone is selfish and unwilling to bell the cat by applying the only solution that makes sense: more housing. The landlords are selfish. Those with rent control are selfish. The homeowners are selfish. The only people who aren't selfish are those at the bottom of the food chain getting taken to the cleaners by the landlords, primary tenants on the lease and the homeowners blocking all zoning improvements.

I'm not poor, but I'm certainly not rich either. I earn enough to to live in this city, but certainly can't afford to live comfortably at $1500 a month, especially when I help out two other family members with money. That being said, absent other better systems for filtering, putting out a classified ad at a high rate is still a practical proxy for what you want in a roommate, even though I'm one of those filtered out by an ad for a $1500 room.

If you were a master tenant with a 3 bedroom for $1500 a month, would you put a classified ad for each room at $500 each? Answer honestly. I don't think anyone would (or does since I've never seen such an ad on craigslist and I know that there is no lack of rooms that should cost that much with ~175,000 rent control units in San Francisco.)

Furthermore, with supply as constrained as it is, nobody will actually read you ad or care what it is you want in a roommate. At $500, everyone will apply whether or not they actually meet your criteria. Let's say you want to live with single, pet-free non-smokers between 30 and 40 and you say so in your ad. Do you think that hundreds to thousands of people who don't meet that criteria will refrain from sending you an email for a chance at living in a $500 a month room?
That might help preserving the backup, but that contributes to the bigger problem (since you are supporting those who proliferate DRM). Voting with your wallet and avoiding distributors who insult users with this unethical garbage is a better approach.
I just added a feature to the game that watches certain functions and compares them to what they were at the start of the game (during the level validation phase). I'm sure this can still be gamed though.
Yes this might work - you could also have a bidding process where you put up your shares and the various pools can bid on them.
That is not accurate.

dist-upgrade is when you are upgrading from one release to another, i.e. a major update, some downtime expected. It's main claim to fame is that it is able to remove a package if necessary for the upgrade (necessary because packages get outdated and removed).

For normal upgrades you don't need it (but it's harmless if you use it anyway). A normal security upgrade will never delete any packages, so using it doesn't make any difference.
"Large portion of the planet"... you've got North America, South America(some exceptions), Europe, a good chunk of Asia and Australasia. That's a pretty reasonable selection of places to live isn't it?
It seems like you are somewhat new to the Debian utopia. Here is another great package that a lot of people are not aware of `apt-listbugs.` After you say "yes" to apt-get upgrade, apt-listbugs queries bts for bugs in the packages:version you are about to install. If any bugs are found you have the chance to review the report to see if it applies to you and if it does you can have apt-listbugs pin the package so that the new buggy version is not installed. Every night at midnight (i think) apt-listbugs queries bts to see if the bugs are still relevant and unpins the package if the bug is no longer relevant. It is especially handy for testing/unstable/experimental.

By default it only prompts you for grave-serious bugs. I have been bitten a couple of times by "important" bugs so set listbugs up so that it also checks for "important" bugs. This makes it a tiny bit noisier but not enough to make me switch to the defaults. Changing the severities is easy:

diff --git a/apt/apt.conf.d/10apt-listbugs b/apt/apt.conf.d/10apt-listbugs
index 13b5409..857f3f4 100644
--- a/apt/apt.conf.d/10apt-listbugs
+++ b/apt/apt.conf.d/10apt-listbugs @@ -4,5 +4,5
@@ DPkg::Pre-Install-Pkgs {"/usr/sbin/apt-listbugs apt";};
DPkg::Tools::Options::/usr/sbin/apt-listbugs "";
DPkg::Tools::Options::/usr/sbin/apt-listbugs::Version "3";
DPkg::Tools::Options::/usr/sbin/apt-listbugs::InfoFD "20";
-AptListbugs::Severities "critical,grave,serious";
+AptListbugs::Severities "critical,grave,serious,important";
// AptListbugs::IgnoreRegexp "FTBFS";
Improper appeals to authority are not limited to appeals to false authority; appeal to authority to dismiss evidence are also fallacious.
Probably most of the time it's not demanded by authors, but by legacy publishers. They have some distortion in their mind, which was already compared to Lysenkoism:

http://www.publishersweekly.com/pw/by-topic/columns-and-blog...