skysight-inc/HackerNews huggingface dataset:
There's not much in the way of contrary opinion here, so let me offer some. The approach of not tying you to a particular architecture is fundamentally wrong. The right way is to expose APIs for each processor architecture.

Here's why. SIMD offers no new capabilities (1), only more speed, and not much more at that, maybe 4x if you're lucky. It's also hard to use: it requires unnatural data layouts, and lacks many operations (e.g. integer division). None of this is specific to the .NET implementation: it's just the nature of the beast.

So successfully exploiting SIMD is not easy, and requires thinking at the level where instruction counts matter. And because the amount of parallelism is so limited, high level languages (by which I include C!) can very easily blow away any gains with suboptimal codegen. Just a handful of additional instructions can ruin your performance (2).

Here's what will go wrong with an architecture-independent SIMD API:

1. Say you invoke an operation without an underlying native instruction. The compiler is forced to implement this by transferring the data to scalar registers, performing the operation, and then transferring the result back. Game over: this exercise is likely to eat up any performance benefit.

2. To avoid this, say you limit the API to some "common subset" of all extant SIMD ISAs. The problem is, many algorithms admit vectorization only through the exotic instructions, such as POPCNT on SSE4, or the legendary vec_perm on Altivec. If this instruction is not exposed, you can't vectorize the algorithm. Game over again.

That's why software that takes advantage of SIMD invariably has separate implementations for each supported ISA. .NET should have followed suit: expose an API for each ISA (or a mega-API that covers all ISAs), and then provide rich information about which operations are implemented efficiently, and which are not, to allow apps to choose an optimal implementation at runtime. This API would demo and market very poorly, but the engineers will love it, because it's the one that enables the most benefit from SIMD.

1: with rare exceptions, such as the new fused multiply-add support in x86

2: Several years back, VC++ generated an all-bits-1 register by loading it from memory, instead of issuing a pcmpeqd, which caused my vector implementation to underperform my scalar one. This is my fear for the .NET implementation.
There's also an .agignore file which can be in your project folder or in your home directory for systemwide ignores.
Thanks! Do you know this because you work with him and are relaying his report of that approach in this particular case, or do you just expect that's the case from his usual technique and prior cases?

Wouldn't that track record of awesome ability, and his support for the Freedom of the Press Foundation, also potentially make him a sought-after expert about mysterious things that a journalist didn't understand in a leaked NSA (or other) document?

Do you know if the Codenomicon researcher(s) found the issue in the same way? (Their corporate webpage makes a big deal about their fuzzing tools.)

Do you believe it was just coincidence that both recently found this same monumental vulnerability? How long would Mehta and/or Codenomicon typically privately research such a bug, with or without coordination with OpenSSL maintainers, after first confirmation of danger?
I've always been under the impression that retirement isn't just meant as a reward to those who've worked hard, but as protection to those whose age are likely to start negatively impacting their work.
Critical crypto bug exposes Yahoo Mail, other passwords Russian roulette-style
I enable Wifi and let it login. Takes 3-5 seconds.
When you have a CA rekey a cert, they will revoke the old one. (This doesn't apply if you are using your own CA, I'm only talking about commercial ones like Globalsign, Geotrust, Comodo, etc...)
I understand that a lot of OpenSSL features were implemented by or because a company sponsored a specific feature, but was only interested in getting that specific feature done rather than any wholesale refactoring of the code. So it's had a bunch of different projects glommed onto it with no overall structure.
> Many are saying that one problem with Haskell is that you can't eliminate side-channel attacks due to features of the language. I disagree. There is no common language better than Haskell at encoding invariants in the type system. One could, for example, implement a "biggishnum" library in Haskell using large but fixed size integers and constant-time operations.

Why do you disagree?

Timing attacks are probably the easiest kind of side channel attacks to prevent but CPU cache line eviction and branch prediction are a lot more difficult to deal with. Especially when using a programming language with managed memory where you can't be quite sure what kind of memory accesses a program will perform. And in the days of virtual machines on cloud servers, they are very relevant.

I do not think that it is totally impossible to write Haskell crypto code without any side channels, it is certainly more difficult than writing crypto code in C or Assembler.

But the big problem is that now you'd need the programmers dealing with crypto not only to be proficient cryptographers but also experts on the internals of the Haskell runtime system. That's a pretty tall order.

I would like to hear from the original authors of this library, what was their motivation in starting this project? I am sure they were not unaware of the potential of side channel attacks. I don't think this project was started with the intention of replacing OpenSSL in production use, but perhaps for fun or educational purposes. Or perhaps to write offline tools for creating and validating certificates, etc.
It's blogspots "Dynamic Views". Complete dreck. I can only assume it's the default when you create a blog nowadays as I have no idea why anybody (least of all developers) would opt into that crap.
Hmm. Damn.
In general I agree with this approach. However, with many people who do it I see that they don't really plan for the future. I'm not for running in the treadmill out of fear, but there may come times in the future where more money is needed, and jobs don't come along as readily as they used to. Or some disability might prevent people from working.
It's a sadly commonly used theme that also does not display anything at all if you don't enable Javascript.
Pugmarks recommends content that you would love to read
Social entrepreneur as game changer
I just hope that the projects that are created are generalizable across municipalities instead of being geared to just one city. Every time I see these open government projects they also come across as very city specific.
> It is really difficult to refactor such things at the public API layer once they are widely adopted by 3rd party projects.

But how did it ever get so widely adopted, if it's so hard to use?

And even if it is widely adopted, that still shouldn't stop anyone from forking it and fixing all the problems.
...just answered it for me. I scp it across intermittently, as I rarely actually use it on my phone.
Have you seen the source?

Have you verified the source you saw is what actually runs?

I understand you actually might have; genuinely interested there. That said, no way I'm going to trust them, especially post-PRISM.
Not to mention all the fellows using Unity (or previously XNA) to develop games with. Writeoff #1 always seems to be "not quite fast enough" and each high performance option can help take a chunk out of that population.
"Timing attacks at least require colocation in most cases and are much harder to implement and run for meaningful results"

Not true. It's long been known that timing attacks over a LAN are practical (replace LAN with intra-datacenter network). Relevant paper from 2003: https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf
I agree, but it's not always in your control, and even then it just delays the same issue. Most people's health starts to decline before they die.

To be clear, I'm very much in favour of the approach that Nathan proposes. I just don't think it could replace retirement.
The CLI is running in a processor, isn't it? I guess your argument is that the software using CLI is potentially affected by more bugs ;)
The 1978 edition of BASIC Computer Games did have permission from Paramount to use the Star Trek trademarks, but this probably doesn't apply to ports. http://www.atariarchives.org/basicgames/showpage.php?page=15...
That was quite a grownup mea culpa. Sorry, I meant mature.
Plausible deniability is when you have a hidden datastream inside another encrypted one, as there's no way to prove it is or isn't there without the key. See: TrueCrypt.

PFS means "If the server's private key is later compromised, it can't be used to decrypt past captured traffic".
Taking the Hit
But which has high/small learning curve, from your experience? I got knowledge in Java and Php. I am looking to scala but I don't know if it's worth.
I would guess this is due to the underlying ISAs. Most SIMD ISAs don't have a quick way to, say, replace the 9th byte in a 16 byte vector. Since the whole point of SIMD is to make stuff go faster, it makes perfect sense to omit operations which are slow.
I do not believe a mobile GPU can handle rendering in 3D @ 1440P. Even desktop GPU's have problems rendering it at 75hz.
Minecraft. Unreal engine modding. And so on ..
There are cheaper ones such as GeneXproTools.
Xkcd's take on Heartbleed
Another 'use namecoin's model' suggestion? Please, please, no. I don't want to place authority for issuing certs solely in the hands of people with mining hardware or botnets, or lots of money to buy form the aforementioned.
You can explain why prisoners in the UK still don't have the vote then?
That's what this referred to:

> or you need to record every call-site with inlined code and be prepared to overwrite it with fixups if the implementation changes.
With fast native code its more than practical to search the entire space of floating point numbers and guarantee that you find the optimal magic number:

http://jheriko-rtw.blogspot.co.uk/2009/04/understanding-and-...

As already mentioned in another comment it has been taken further by Řrřola who has optimised a version with the newton step including the constants involved in that.

http://rrrola.wz.cz/inv_sqrt.html
DNS Authoritative Name Server attack
I prefer postits.
Show HN: Android Game made in 2 days
By "all this rewrite talk," I meant the article, your comment, and several other comments in this thread together. What about my comment indicated that your question was a problem for me?

"Done," answered your question. $0.
> So the actual protocol change that needs to be made in order to make challenge-response protocols fully effective is basically the inclusion of merkle-sum-trees

Where do you think the words "merkle-sum-trees" came from? :)

> Unless you do some crazy ugly hack like creating a separate overlay merkle tree with its root being output 1 of the coinbase, that's a hard-forking protocol change.

No crazy hack is required. You just include a commitment to a merkle-sum-tree tree of transaction values, along with the UTXO commitment. It doesn't have to commit to transactions, it's just a tree of values. There is no loss of efficiency, you don't even have to signal the data normally since all full nodes already have it.

> As for changes actually being implemented, to be honest I haven't seen anything actually substantial since P2SH

Well thats a step back from the position you took above that it can't change at all ever. Now the changes have been not substantial and not often enough. ::shrugs::

> that would benefit everyone

It's highly debatable that it would benefit everyone now, we're certantly not up against the limit. People are still using the blockchain in very inefficient ways, and the ecosystem of tools to increase efficiency hasn't developed yet. At the same time the count of full nodes is falling— increasing the cost of running one right now may not be a good strategy.

> so I think it's unlikely that Bitcoin will develop second-layer scalability protocols first

I don't have any interest in being first. I'd much better have a well designed and considered approach. Unfortunately, so far, none of the alt-systems— even ones which raised millions of dollars of funding— have developed anything that turned out to be useful to implement in Bitcoin. Maybe that will change.
BulletML for Unity 4.3
this would be a fantastic app to detect image tags automatically / correct itself based on user input... perhaps a captcha type method of tagging images ("cat" and then "not cat" )
Also a user of this. Never had a problem with it. Have contributed to the third party scripts. Hope it never goes away!
"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"
I'm far from retirement, but I do believe that every phase in life is what you make of it.

In other words, that might be the default state of retirement for some, but that doesn't mean it has to be like that. All retired people I know (including those who are widows) make sure to keep people around them and have various hobbies or found volunteer work that they are still able to do.
This is very interesting. I wonder if anyone knows what can be gained in terms of separating out different topologies by allowing for a restricted family of conformal transformation on top of the tanh functions, of the sort that allows taking the insides out and so forth. Comments?
Did you ever noticed, that not always the best Code/Tools are used in projects ?

Its a pattern that you can watch on many IT-Projects.

Some "Key-People" like a project (for whatever reason) and a mass of developer follow them.

And than a thing get "standard" and more and more people use it.
All of these look like enhancements to me...
Skimming through this list was jaw dropping.
I'd be more impressed by this if I didn't constantly see the same exact few movies in the sliders when I browsed. It makes it feel like this is a presentation that demonstrates what a total circle jerk their culture is. How about getting things done and surfacing more movies for me?
This looks really cool and something that will be fun to play with.

jetpac looks interesting too.

Any idea why they released this framework?
Outbound sales made easy
Semi amusing development stories
Well last night was a fun evening. Spent over a hour (billable time) explaining to a client I was not being rude within their project code.

How did this come about? Well the client asked to see their project and being a good obedient developer I complied. I opened up a remote desktop share session and got down to it. So I showed them their project and all was good all be it a few textual changes.

So I cracked open the project folder <website>.git. Wait, STOP, "why has my project got the word git at the end of it? Is this what you think?" At this point I think the word which came out my mouth was "Errmm, Huhh what?". To cut a long story short I had to explain that I didnt think he was a git (nor his project) and that in fact it was a technology.

Disaster inverted!

Well until he saw the grunt folder (and my push script grunt-onto). At this point he must have been tired and decided he had enough of gits and grunts and called an end to the meeting saying "how disappointed he was with my humours attempts in this `oh so important` project". I then had to craft an email to him with links to the project websites to prove in fact I was not being a but they are actually technologies.

\\ slaps head //

Have you ever had any misunderstandings involving project terminology or a client who just didnt get it; or is it always just me?*

Virtual punch in the head for the person who first mentions forking.
NuGet Package of the Week: Humanizer makes .NET data types more human
I am a bit reluctant to repeat myself, but I can't see
any mentioning of the sheer volume of code. It's more
than 300.000 lines of code in the .c files of the official
tarball.

My experience with code grown beyond >10⁵ LoC is that it
forces you to monkey-patch around any bugs (or even
features for that matter). Surely there's a Potterson's
Law or something that describes the situation.

In short: it's not the monkeys (quality),
it's the volume of code.

(Of course now we're getting in a chicken-egg situation.)
Yep, just came here to note ag. ag is fantastic and I have it installed everywhere I might need to grep a tree that's not in git. (ag's author notes that git grep is usually faster, if you're lucky enough to in fact be grepping a git repo.)
iirc they're aiming for Value types and a new JNI for Java 9, so that could simplify some of those issues.
Well I've never seen it before! Reposing material like this is a good thing.
Ads are annoying. People bitch about annoyances. No wonder there.

"Someone has to pay for this" is the wrong attitude. Either the service provider provides the service or he doesn't. If I'm not in a contract to pay them, I don't assume responsibility for paying anything...
That's interesting, I'm curious, where are you from? I'm always interested in learning about cultural differences.

Oh, and...

> Even among those with well-paying jobs, most of them probably work for companies which would never let them do that.

That doesn't mean it's impossible :) If you have a well-paying job, that probably means you can later find a good job at another company too (otherwise why would they pay you so much?)
I'm spending the winter in Melbourne Australia right now and am surprised at how few homeless people there are here. I don't really know why, but there appears to be more homeless in my home base of Boulder, CO (pop. 100,000) than here in Melbourne (pop. 4,000,000). I'm assuming there are better social safety nets here. It's quite nice that you aren't constantly panhandled and you can walk through the parks at night without fear.
In many parts of Asia its economical to eat out for every meal, not just for the rich. In Vietnam for example many street food vendors have a minimal markup on the cost of the raw ingredients, something like +20%. Same for a lot of cities in China as well I believe.
> It probably would be slower though, which is kind of a big deal for webservers and the like.

More critically, it would only be useful to Haskell code. Haskell, unless C, cannot be embedded. Having a version in Rust - which does not rely on the runtime - ought to be safe from this kind of issue (baring any problem in Rust itself) while being still embeddable from external code. It would still be somewhat slower than C, and of course Rust is far from mature.
It still might be invaluable for the kids.
Catching the vtable updates and propagating them downwards is pretty simple, you "just" need every class to know which classes inherits from them. There's an implementation for dynamic runtime updates of dispatch tables for Oberon, of all languages (though that version sidesteps the "sparse vtables" issue by splitting the vtables into interfaces, and adding one extra level of indirection).

The tricky bit is if you have gone as far as inlining the method.
> Trying to shrink an app designed for a desktop browser down to a 4" phone is a fool's errand

That's why, when you design a responsive website, you're supposed to think / work out mobile first.

Hoping to detect all mobile devices out there based on their http request is no wiser.
Most people don't bother - they just start using a different one: gnutls, nss, etc.

Yes, reports of awful code quality in OpenSSL are not exaggerated.
Usually there's a "code of silence" between crooks such as these. They know that if they started digging for another, they'd have others dig for their shit.

Plus, it's not like anyone will use their information to make their life hell or put them in jail. At worst, they might be denied some promotion.
Ask HN: What's the purpose of the "payload" in SSL TLS/DTLS Heartbeat anyway?
Having read through RFC 6520, I don't understand why the payload is necessary. Neither the server nor the client appears to be using it for anything?

Wouldn't it have been simpler and more secure to skip the payload altogether?

In a security protocol it seems strange the designers of the protocol opted for a more complex protocol than necessary.
Great analysis. Theo is always up front on this sort of stuff which is commendable.
Say 'No' to customers systematically
http://www.engadget.com/2013/10/18/oculus-rift-john-carmack-...
Thanks.

It's really fascinating, and what fascinates me in particular with Ruby is exactly that once you start looking into it, there are new problems around every corner, and trying to make it as "ahead of time as possible" makes it even trickier - I absolutely agree with you that there are parts that are much easier to do if you JIT, though, and I'll have to go there anyway to handle "eval"..
This should be a case study about why people developing system-critical software shouldn't write their own memory allocators.
I have a kind of fractal approach to this which is more viable for my use-case (self-employed, long-haul projects):

Don't work half of the day. Don't work a day in a week. Don't work a week in a month. Don't work a month in a year.

I've tried what's described in the blog, but it was too fickle and not enabler of bigger things.
I now feel good knowking that my private key is safe.
I do this each month, where I work enough to support us for the rest of the month.

Unfortunately, it's always at the end of the month when I reach that goal.
Show HN: Archange, My first iOS game
And note that Ruby eigenclasses are in effect perfectly normal classes, with the exceptions that: 1) they dynamically get created the first time you define a method on it, 2) they are then "injected" into the inheritance chain, yet hidden from you when you try to follow the inheritance chain.

In effect, from an implementation point of view (at least for MRI), they're just normal classes except for when you define them, and a handful of insignificant cases where you have to check a flag to determine whether or not to consider them.
Where others see only barriers, innovators see opportunities
You could terminate connections with it and have a local socket to another process. As we have seen putting ssl in another process is helpful for memory isolation...
I wouldn't know, but in any case that would require allocating the whole 64KiB for each connection, when the actual heartbeats can be much smaller. Wouldn't the memory waste be worse than the allocations?