skysight-inc/HackerNews huggingface dataset:
I might be completely wrong but I don't see much difference between open source and closed source in this case. If I were biased I might say that it might have taken substantially longer to discover such a bug in closed source software but that seems to be as much sensible as saying that open source has less security bugs because more people look at the same code.

In the end software is written by people and people make mistakes. I'm pretty sure there are a lot of software be it open or closed source that had absolutely terrible security bugs. Judging open source as a whole by looking at a single project sounds a little bit like overgeneralization. Also, they are obviously in need of help though, I hear a lot of complaints from people about the OpenSSL code.
I think the point is that deployments should be streamlined and we should not make such a big deal out of them as many of us used to.

If the code for a new feature is ready and all the tests pass, being able to deploy with the click of a button allows you to close the ticket right away and move on to the next task in line. Also, there's no need to coordinate with other developers that are about to finish their thing.

Overall, it's good for productivity and peace of mind, as streamlined deploys are less error prone.
This is why you can, on Debian/xbuntu, always run a apt-build from the source and verify the patch is present in the code. Or on Gentoo, it's building from source anyways.

(Or just use Debian in the Gentoo flavour from the beginning)
They're clearly closely related, but it would technically have been possible to represent strings using a header with a length field followed by the characters in the string. That would have required people to pass the location of an arbitrary character as two explicit values, the string itself and an offset, which would certainly not have been in the spirit of the way C takes advantage of pointers, but nonetheless would have been possible.

BTW I must take issue slightly with your characterization of the problem. Arrays decay to pointers immediately when referenced, not just when passed to functions. I suppose a C implementation could do bounds checking on non-pointer-mediated accesses to local arrays, but I've never seen an implementation do that (except those that do bounds checking more generally). Did yours?

In fact, the way I put it once was, "C does not have arrays. It has pointers and notations for allocating and initializing memory; it does not have arrays." (Meaning, of course, "array" in the sense of a firstclass object, with bounds checking.)
if you read the article, it summarizes it.
While there's no evidence (yet) that the NSA knew about or exploited this bug, I would not be the least bit surprised if they did. Honestly, my first thought when reading about Heartbleed was "I wonder how much the NSA paid the contributor. Or did they just threaten his family?" It seems there have been a lot of "oops" errors being found in critical security systems these days, and every single one of them is directly beneficial to the NSA and its mission to "h4ck the plan37!"
And it should be pretty easy to forge the license plate frame for a heck of a lot less.
All governments are hypocritical. We have nukes, but you can't have them; we can spy on you, but don't spy on us; etc. It's the nature of self-interest.
I looked at the code and I'm pretty sure I saw that the payload size variable was a long int, so I was confused by this too.
I think it further indicates that not enough review of the code was done before it was integrated. Dumb variable names like that should be caught at review time.
The same thing you do with RSS/Atom feeds. They don’t magically disappear unless they’re deleted.
If you mean you think they would get buried under regular human tweets, you can make a list. I have a news list for this.
UTF-8 got it right with having a variable-length byte representation of numerical values. Seven-bit values unaffected. Longer values use more bytes as necessary.

The C approach takes a whole different philosophy. You want a "string"? NULL terminated. Simple. You want a buffer? Do it yourself.
It is all about feedback loops. If you finish a feature and no one sees it for a month because your on a monthly roll, you don't know if it really works for them. And if it comes back and needs an improvement, you have to figure out what you were doing again. Two month iterations are hard to learn from.
Didn't he have pancreatic cancer? That's not the kind a little chemo can fix. It has a very high rate of mortality. Patrick Swayze died from it not too long before Jobs.

I'm not defending the new age medicine he opted for first. But I don't think it's what caused his death. Might have hastened it a little is all.
"Financial records of the OpenSSL contributors"? How extremely silly. Knowing about Heartbleed? Easy to see. Not sharing Heartbleed? Easy to see. Deliberately introducing a vulnerability that every single US adversary could trivially find? Beyond unlikely.
It sounds like for a lot of these companies, their idea for "growth" is cost-cutting. This isn't even economics 101, it's simple common sense: if something is cheap, more people will buy it.

It turns out selling at below-cost prices is a fantastic (though ultimately futile) "growth hack".
For the curious, 4 results:

http://www.redfin.com/city/16163/WA/Seattle/real-estate#!max...
That's not quite my reasoning, so I'll try again!

pgSQL does what it does easily enough that it reduces the barriers to entry to such a level for traditional RDBMS workloads (which there are plenty of) that such workloads are simply not economically worth pursuing (especially for startups) except as small components in larger systems where the value add is elsewhere. The "other" world of big data/time series/graphs/nosql is hard to get right, and so is worth more, as if you crack it someone else copying you is decidedly non-trivial, meaning that it alone can form the core of a successful business.

This is a bit like what the web people are trying to do in mobile, where if HTML5 was magically the best cross platform mobile deployment option when we wake up tomorrow the value of mobile developers will collapse, and the web people will then cease to be remotely excited about mobile.
“It flies in the face of the agency’s comments that defense comes first”

The NSA needs to be dissolved. It is a costly liability whose actions work against the nations interests as a whole.
Yes, and it's entertaining too - very well done
I can confirm that HP Fortify SCA does not find this bug.

(I am the architect for the SCA team.)
Yes, but when do you get there? In 50 years in your time, but it may be a few billion years later in their time...
From an interview of Nathan Myhrvold on Fareed Zakaria:

Zakaria: How worried are you that the United States is no longer going to be the place that invents the future?

Myhrvold: I'm very worried. Current course and speed --- we're very good at inventing, uh, but we're also undermining our ability to do that in lots of ways.

<facepalm>
I have think about use it, but still it fail if the data is relational. I have a invoice app, and none of the NOSQL I have evaluated guarantee the order of the updates or have atomic updates (need both). Is not fun if a invoice update partially or the related tables get out of sync.

In the other hand, I'm stuck in how sync with a relational model :(

So, it sync well and broke my relations and transactions or it sync hard but keep my data correct.
The biggest problem with openssl is they ignore bug reports.
How come it is news that Apple invested in an IV fund in the past, but is not investing in this new IV fund, but it is not news that Google invested in an IV fund in the past, but is not investing (as far as we know) in this new IV fund? Or Yahoo? Or Nvidia?
Are there any cases where the actions of the NSA are in any way beneficial to US citizens? Can they show that they have ever done anything positive at all? Have they saved a single life? Stopped a single threat? Or are they too busy jerking it to sexting pics and playing WoW (seriously? Come on, guys) to actually do anything useful with the BILLIONS of dollars of money that they get to play with?
You might want to also check the site search for past entries. This question comes up at least monthly here in an Ask HN: format. Heartbleed hasn't changed which password manager I've used but that's b/c mine is offline. It may have changed some other folks' though.
I believe that is the point. Even more time for the stationary computer to finish the calculation.
You'll almost never get pulled over for doing exactly 11 over on any street with a speed limit of 50 or higher. Thanks to the law of cosines, a cop is likely to read you going 10 or less or less, and cops generally don't even bother with people doing 9 or less over, especially highway patrol.
I love being a software developer and I am great at my job.

My other coworkers are nowhere near as talented and the lack of peers greatly contributes to my frustration (which makes me unmotivated).
Whether or not you want to call it 'significant', every $15 meal they sell for $8 is either $15 or $8 in revenue that a legitimate business didn't get.

This phenomenon literally breaks capitalism, by routing money from those who can create a product for that price to those who are subsidized, because they're 'innovative' enough to make a cookie cutter mobile app and wear skinny jeans with fashionable glasses.

Now, a standardized delivery model, with a straightforward service charge, and all that? Yeah, great business model. Seamless web is around. They're doing great, and add value to the economy. What value do these clowns add?

You don't seem to disagree with any of this.. your position is that since they'll be out of business soon, the damage is limited? It's still damage, and still stupid.
You don't have to stay frozen. But if you want to have an easy time of things, it's not a bad idea to avoid doing things that might look a lot like reaching for your gun. A relaxed cop is usually a much friendlier cop.
I doubt how anybody can claim they're "driving safely" when the only observer is oneself and there is no baseline to compare against. This is about as statistically meaningful as people buying homeopathy stuff because they "know" it works.

At least homeopathy doesn't kill bystanders.
Frama-C is a suite of tools dedicated to the analysis of software written in C
I'm not an EE, but I imagine that a much better solution would be a universal device where you can connect a chip and run a publicly available test suite against the chip to confirm that is performs as expected.

Like @wyager, I'm extremely skeptical of a program like SHIELD.
Cool or what?
As someone who was questioned by the AUSA and FBI in front of that federal grand jury, from the onset of things, the prosecution wasn't interested in finding justice, only in twisting everyone's words as much as necessary to secure an indictment, and later, a conviction.
Go as fast as you want - but don't be the fastest car on the road.

That sounds like a pretty considerable constraint on going as fast as you want...IME there isn't always a person who wants to go a hair faster than you readily available (especially if you're at the top end of the spectrum in your muscle car - do you drive strictly in areas with lots of fast drivers?). I mean, I'm fully in support of the rule, I call that car the "rabbit," but if you're intentionally following someone you're not going as fast as you want, right?
Remember that this is a conversation about how to avoid a ticket not about maintaining your rights/ego.
Outsource the engineer. At 30-40k salary per annum, they can scrape by on 625 to 833 deliveries a month. 20-28 deliveries a day. You still have to look at paying the delivery guys and managers.
How does an H-1B give leverage to the employer? You can change jobs, you just have to get your new employer to notify the state that they are now your employer.
omega == omega^2. They are the same quantity. For every element of omega^2, there is a corresponding unique element of omega.
Amazon offers warehouse employees $5,000 to quit
It's like, if you can avoid crashing through sufficient awareness and caution, why not save the money and avoid insurance? There's a risk <-> cost trade-off here, and on one side is higher risk lower cost and on the other side is lower risk higher cost.
".. stealing private keys on most NGINX servers is at least extremely hard and, likely, impossible .."

Nice!
>>do you really have to be wealthy to have access to $2k?

2k to spend on a license to speed instead of spending it on rent and food? Yes, you do need to have some excess wealth to be able to do that.
> The agency found the Heartbleed glitch shortly after its introduction, according to one of the people familiar with the matter,

Presumably if the anonymous sources here were discovered, they'd be in big criminal trouble, right? I am curious how far the government goes to try and discover them.

And I think there is no way these anonymous sources would have contacted the journalists without Snowden going first, to establish the context and interest. Snowden's actions continue to benefit us all, cascading.
Last line, can we make that 72 pt font and top of the page?

(HN feature request: soundbits.)

This whole approach to diluting ostensibly one of the most important standards is beyond unprofessional, it's an example of failures on many layers of meta.

I would really like to see a compelling alternative to keep TLS honest, perhaps with Convergence-like ideas and bare-bones level of features.

The problem is always adoption, corporate fear of change ($upportabi£it¥) and endpoint adoption, but the threat of an alternative might be enough to scare the bejebus of the WG back to task.
I may be able to help.

Worked full time as an EE for a few years, and now have a small niche electronics business on the side. I can't say that I have the time to take on a design project right now (depends on specifics) but I should be at least able to help you vet the skills of people you find or help you over any sticking points if you want to DIY.

I also recently learned what node is and think it's pretty cool.
Contact info in profile.
“In a typical year the OpenSSL project receives about US $2000 in donations”
This is awesome! Thank you! Would you be open to pinging me at feedback@doerhub.com? I would love to follow up with you.
No, they can't. Read the inverse of my bulleted list to see what makes money:

* Bugs that fit readily into operational frameworks (ie: it would be reasonable to have a UI with a button invoking that bug and/or any of the 15 other bugs like it)

* Bugs that can't be killed with a single patch cycle by a single entity

* Bugs that provide long-term access, or access that is unlikely to get your entire syndicate caught

Example of a potentially lucrative web bug: bug in Wordpress.

Example of a bug unlikely to be lucrative: "read any Facebook server file".

I know that sounds crazy and backwards, but I don't think it is.
"Running a basketball team requires you to make touch decisions.

Do you mean TOUGH decisions?
Jeremy Kun's basic graph theory lecture [1].

[1] http://jeremykun.com/2011/06/26/teaching-mathematics-graph-t...
I believe there is some confusion (at least I was confused until I looked at the code) that the library had universally replaced malloc with another allocator. While the library allows users to provide their own allocator, it is not done by default.

The code in question does not use the freelist implementation. It goes directly to OPENSSL_Malloc which is basically malloc.

What happened was the exploit allowed remote clients to read beyond the size of the buffer allocated by OPENSSL_Malloc. There just happened to be data from the freelist sitting next to it.

Even if the freelist implementation wasn't used, that wouldn't have prevented this exploit. There would just be something else sitting there in memory, but we can't predict what that would have been.
They are probably the most expensive thing you will ever pay for outside of your house (and your children's education), and the debt can't be discharged by bankruptcy.
Similar discussion: https://news.ycombinator.com/item?id=7574776
To be more specific: let's say SQLite has a bug which manifests differently on different platforms. It would be impossible to adhere to the standard.
> The SSL protocol has a history of security problems, Lewis said, and is not the primary form of protection governments and others use to transmit highly sensitive information.

> “I knew hackers who could break it nearly 15 years ago,” Lewis said of the SSL protocol.

Anyone know wtf he's talking about?
Great. We would need a blog post that lands on the HN front page and some other HN readers that are equal minded. Or a contact to Mozilla devs.

There is also a similar one called SQL.js - SQLite compiled to JavaScript through Emscripten (probably a big library too): https://github.com/kripken/sql.js
>> Most highways are underposted and should be 70-90.

Maybe in the middle of Montana or Texas where it's 50 miles between towns, but not anywhere with off/onramps. People are very bad at merging and it'd be very difficult for many vehicles, especially trucks to get up to speed if 90 was the limit.
The L-2 work permit is better than not being able to work at all.

Companies (smart or not) can't really leverage an L-1 spouse against the L-2 job applicant in negotiations, although they might consider the L-1 holder a possible risk factor that might count against the L-2 job applicant.

If this happened or played a critical role in candidate evaluation, it would be difficult to prove that the L-2 holder was discriminated against.

The only time that a company could truly "leverage" the L-1 visa against an L-2 applicant is if the L-2 truly had nowhere else to apply except to the same company as the L-1 holder; but I feel that's an unlikely scenario.

EDIT: To your point about upgrading the L-1 into permanent residence status, it's typically easier and quicker on the L-1/L-2 than via H-1B.
I watched a friend get out of a ticket in California not by having a special license plate, but by being dressed in a suit, and being friendly. He was blatantly going 90+, and the cop seemed annoyed when he first approached the car. Then, I think "this is a rich kid!" clicked in his brain, and they had a nice chat.
I would disagree about the detector. Maybe in Cali or heavily populated areas, but in smaller-medium sized cities and most definitely rural areas they are nice and do work well if you will spend the money to get a nice one ($400-500.) It's not a for sure thing but they do a decent job at detecting a good ways out.
Wow, awesome tip, thanks. This makes the wrapped version as fast as the others. I updated my article accordingly.
The best practice with AWS API keys is to ONLY EVER use IAM (Identity and Access Management). There is nowadays zero reason to even generate account-level API keys. With IAM, you can create separate keys with separate abilities, down to the API call, even locked down to certain IP addresses. Even on my personal account I have separate IAM "users", e.g. one for each S3 bucket that I use for backups, locked down to the minimum access needed for the backup software to work.
Other users can't see the "email" field in your profile. Only admins can see it. If you want us to see your email, you'll have to put it in the "about" field.
Similar discussion: https://news.ycombinator.com/item?id=7572568
why weren't you nice when you emailed them?
Potential energy goes up as a square function of speed.

25mph => 45mph : 1400 "units" increase

65mph => 100mph : 5775 "units" increase

So at least in terms of kinetic energy and therefore destructive potential, 100mph on the freeway is more dramatic than 40mph in a residential zone.
>The U.S. is planning changes to the immigration rules that will make the country more attractive to talented foreign entrepreneurs and other high-skilled immigrants, the White House said in a statement Monday.

Yeah, let's go ahead make it more attractive for talented foreign entrepreneurs, BUT let's only offer a few 65,000 H-1B visas per year... What's the point of making it more attractive if there aren't enough H-1B visas to go around in the first place. Seems some what cynical to me.
You hand the paper to the officer along with license and registration.
Talk about trying to make money off of a negative incident.
This is a terribly written article, borderline incomprehensible. The first linked article is much more clear:

http://www.washingtonpost.com/politics/social-security-treas...
Awesome! It is more readable and makes it faster. Thank you very much. I changed my article accordingly.
Right, I wasn't proposing a completely-unregulated market. Presumably collusion and other anti-competitive behavior would remain illegal. In any event, different behaviors towards fluctuating prices are already observable as differentiators amongst different competitors in this space (Lyft has surge pricing, but it's less aggressive, and Sidecar lets drivers set their own prices rather than controlling it centrally). What evidence is there to suggest that that would stop once cabs disappear?
Now would be the time to start looking up the backgrounds of the people who implemented heartbeat support. For instance, the same guy responsible for the Heartbeat spec was the author of the OpenSSL implementation.

While we do not want to make this into a witch hunt, now that the NSA is involved in Heartbleed, we should definitely rule out malice by checking for direct ties between contributors of known flawed/malicious code related to the implementation of Heartbeat.
> you have never in your life just felt like re-posting a quote off something ...

I do, but I do that on Twitter, because, as you've found out, HN will downvote you into oblivion.

> I have just joined this community I am trying to fit in

Ah ha! Sorry, I didn't see that: usually, new users are in green. (also, your account is 163 days old?) If you haven't checked it out, you should check out the community guidelines: http://ycombinator.com/newsguidelines.html

For what it's worth, I am not trying to 'bash [you]'... but I don't think this was a great comment. Try to keep them more substantial here. Different forums are appropriate for different kinds of discourse, and short little comments are generally not taken very well here.

The same happens to "+1", "thanks", and "interesting!" comments. If you can't write more than two sentences, you probably shouldn't post.
I agree with you in the radar detector front, definitely beneficial. Where I live, with my detector, cops seem to just leave their radar on at all times, rather than targeting single drivers. My detector lights up 1/4 before I can even see the cop. Has saved me multiple times.
My personal opinion is that I doubt the NSA introduced it, but if it allowed other countries to exploit US citizens and the NSA knew about it, then that is indefensible behavior.

That being said, it would be a pretty standard tactic for an AG to look at who paid the people who did the work. It is a pattern in a lot of different types of investigations and familiar to an AG. Will they find anything? Doubtful. Will that really matter? Doubtful.

I should at this point say that I am thinking of a scenario that would occur to an AG (the pattern happens a lot). I am not advocating such behavior. It would have a huge chilling effect on public source code of any type and probably generate some seriously evil legislation (certifications or liability insurance). These concerns have never been part of most politicians concerns.