skysight-inc/HackerNews huggingface dataset:
> Go is created to replace C, a system programming language which could be considered as a niche. You see popular Go projects specifically addressing system level stuff (infrastructure: packer.io, docker, etc).

I'd go a bit further. Go was written to replace C++ when used for servers at google and it excels in that spot. It is not meant to replace C for kernels.
I believe if it was any other website, google would penalize them for spamming their results. But it's not happening due to silicon valley nepotism.
Thanks Jessica! Founders at Work helped inspire Mixergy, so your comment means more to me than you can imagine.

My best question is, "for example?" That helps guests move away from generalities and they start telling a specific story.

The other thing that helps is being open about my own insecurities and failures. It took me a long time to get comfortable telling anyone about them, but whether I do it in an interview or a private conversation, it helps the person I'm talking with get open.
Looks like my server is having some issues. The post is also on GitHub.

https://github.com/morgante/spiped-docker/blob/master/readme...
Wouldn't I know when I'd do that? For example, civilization has known for decades now how does a thermometer work. It will show correct body temperature only at a few places. If we can somehow isolate the sensor to not to read its own machine temperature but read the ambient temperature, I think it'll be a big thing.
The business model an practices of the company are completely irrelevant to the people concerned in this case though - the users of the web browser. They never signed up for shit, and they have no incentive to trust a business which refuses to invoke compromised certs because people are unwilling to pay.

Yes, this doesn't make them untrustworthy as a business, since their business model was known - it does make them untrustworthy as a party which is meant to be securing the web though - because they'll be failing at it spectacularly.

Again: I never signed up to shit, and their business model means shit to me too - I just want some degree of security when browsing.
This is a plus to distributing your own app...you can just bundle the public key(s) for your servers with the app

Yes, this is one of my standard recommendations: If you can, distribute your own damn keys.

in Tarsnap's case, an SSL leak wouldn't be terrible because everything's encrypted before even going over the wire

Correct, and requests are authenticated using signatures, so even if Tarsnap was using SSL, there would be no tokens disclosed which could be stolen. Breaking Tarsnap's client-server encryption/authentication would allow an attacker to identify the names of blocks of data, though -- so he could see e.g., that someone is deleting today the data which was uploaded yesterday.
I use factories a lot when using Django... But, of course, in Python they are functions that return a class, not classes.

Interfaces instead are completely unpythonic. Or, maybe I should call them antipythonic?
Wait... this isn't one giant terabyte zip file we're talking about right? This is a bunch of 3 - 5MB jpgs, some 75MB-300MB video files? That accurately describes the media I have starting from 3 years ago when my daughter was born.

A failed upload only interrupts the file currently being uploaded, not the previously successful ones.
I'm sorry to hear that. I have been successfully running a web app on ubuntu/mono for four years now and I'm really happy about the stability and performance. It doesn't use any of the asp.net stack though.
Ask HN: Did anyone get to ride with a Google Ventures partner using UberPitch?
Why Etsy’s Future Depends on Redefining ‘Handmade’
You can trust some of the certificates the produce, but you don't know which one. A responsible person would trust none of them, because you can't know who you can and cannot trust.
Go was created to do the systems programming tasks people used C++ for. But what has resulted is that very few C++ users have switched to Go. It's mostly been Ruby/Python programmers and they are using Go for network programming, not systems programming. It's just another bit of proof that language designers, no matter how brilliant they are, such as Ken Thompson and Rob Pike, almost never know who is going to adopt their language and what it will be used for.
Exactly, I find it hard to care for the "you gave me free stuff so you owe me more free stuff, never mind the contract" crowd.
The Tarsnap website is running on FreeBSD 9, which gets OpenSSL bug fixes backported.
From the article:

> In my experience, the spiped tunnel is highly reliable and recovers more gracefully than a standard SSH tunnel.

I've never had an issue with ssh -D though
I used to listen to his interviews a year or two ago, during my commute. He is a fantastic interviewer, really digs and asks specifics of how an entrepreneur decided something. Congrats to him!
While I wrote this with tongue in cheek, I also aimed to illuminate the power of Python's flexibility along with the inherent danger therein. I do admit the Javacious example was over the top though ;)
Exactly right. I borrowed that term from Chapter 2 on Collective Intelligence [1]

[1] http://shop.oreilly.com/product/9780596529321.do
As for why not the simple `ssh -D` the author states:

In my experience, the spiped tunnel is highly reliable and
recovers more gracefully than a standard SSH tunnel.
Great job, I like it a lot. Congratulations on graduating soon. I wish you luck in all your future endeavors :)
Previous HN discussion on Monkeysphere, a Debian project which implements something like what the author envisions: https://news.ycombinator.com/item?id=6617132

And the description from the Monkeysphere site on why they are a better alternative for HTTPS: http://web.monkeysphere.info/why/#index1h3
And there may be other things besides web servers using OpenSSL that you didn't think of or aren't aware of.

For example, I believe that using curl to fetch an https URL leaves you open to this vulnerability if you connect to a malicious server. The odds of the server being bad and the odds of curl containing anything of value are low, but it still counts for something.
The current cohort of languages-of-the-moment is being cannibalized by the node.js silver bullet it seems.
OpenSSL frequently hosts vulnerabilities that don't affect all users of TLS. If you pay attention to the updates (as Colin surely does), you can filter down to the updates that matter.

It's a risky thing to do if you're not willing to own those judgement calls; I wouldn't recommend that most shops do that. Among other things, you need to eyeball the diffs.
Why do you not include yourself in the list of people that work on it? Who are these other people that should be working on it? There's only 2 people on the OpenSSL team apparently.
I like this one. I don't know enough Haskell to have come up with it on my own (but I should!)
Never underestimate the power of language. Yes, we know it's a pre-recorded message, but we also know a human wrote those words. I'd wager that a self-checkout that barked out commands without ever saying please would sound rude, robotic and harsh to users.
> Surely systems programming is more popular than web? As you need a system to access the web, but not every system accesses the web...?

"Systems programming" != "Systems software".

Systems software is more widely used, but written by fewer people.
Your analogy does not allow for the distinction between revocation and renewal. You might not expect the locksmith to renew your lock for free - but you should be able to remove it without paying him.
Dang I got that wrong twice.
I didn't like those inconsistent style-over-substance design decisions in iOS7. Maybe Forstall and Christie just wanted to be a voice of reason and got sacked for it?
I mean... no hate but this doesn't sound like a case of college is useless. If you tried your hardest and failed out, then maybe engineering isn't for you. I understand the engineering curriculum is much harder, but the fact of the matter is, to be a decent engineer you should be able to pass. It'd be a different story if you were failing because you were disinterested and had much better things to do with your time, but if you were failing because you can't get data structures or discrete mathematics then maybe it's time to change fields.
Go exception handling (or lack thereof) sucks. Things can just blow up silently at runtime unless you check the error code return of practically every statement.
The McDonalds Monopoly Fraud
Sad reminder of Ian Thorpe. I hope he gets through his illness, although I hear it's unlikely that he'll swim again.
Many people want to be where other people are - the center of the action for their particular universe. They vote with their money.

You're right that status is a big part of it. Manhattanites look down on the "bridge and tunnel" crowd.
Thanks!!

re: alexa reference: we had hit 5,000-ish on alexa a while back (then google had some fun with Q&A sites) - at that level we were getting around 180,000 uniques a day. 40k was the difference between 7000 and 5000 on alexa, it's also not as 'exponential' as one might think.

I previously would assume more than 10 mill a month, but I tend to imagine the guys above me must be 'rolling in traffic'. 10 is probably closest.
Mobile browser behavior: Redditors vs. Moms vs. Entrepreneurs
He probably sent him a link to one of those much better iOS flat GUI redesigns from independent artists.
Oops, I read the question backwards. In that case, maybe because he wants higher performance? ;-)
Today in the App Store – the best free apps, new apps and app updates
A serious question (not saying you're wrong, I'm just genuinely curious): What issues have you run into with Go and Windows? I've been shipping libs and programs written in Go for Windows without issue.
You can tune Hound (and Rubocop) to your liking:

https://houndci.com/configuration

> the change is a false positive

I've been using Hound on about a dozen projects the last few months and haven't seen false positives. We built it atop Rubocop, which has been pretty well-vetted.

> Software development has too many unwritten rules and social interactions for a bot

We've limited our guidelines to a subset that should almost always be "no argument, my bad, fixed in [SHA hash]." However, it comments instead of failing the build or mechanically changing the code because that the human should make the final decision about whether to make the change.
Many problems need generics to be solved elegantly. Go doesn't have generics. It is completely impossible in Go to write things like user-defined polymorphic container types.
I'm trying very hard to write Python in VB.Net at my job. But I've not been very successful, Python is very flexible.
I like the solution, but I usually keep "The Zen of Python" in mind when writing 'Pythonic' code.
What about Opera 12, still major browser in CIS countries? OpenSSL license is listed on opera:about page, but version is not specified. How to find out?
That's the whole point--to force you to actually handle errors properly. You could say the same thing about any language with exceptions that you don't catch.
Systems programming is further down the layers of abstraction than Web Development is. As you go deeper and deeper down these layers there are fewer and fewer people solving the problems that the layers above depend on.
The older posting that is mentioned, which is called Securing an HTTPS Server is a good read: http://www.daemonology.net/blog/2009-09-28-securing-https.ht...
And here I thought the "gun to the head" was more of a "smoking gun" -- as in, hey, that MITM attack you thought you could get away with? Yeah, we noticed.
You can do better than complete waveform time of arrival.

Sound propagation in water is dispersive (higher frequencies travel faster, but lower frequencies travel farther). With an accurate model if the chirp waveform, you can determine distance more accurately by looking at the amount of signal "spreadding" and the amount of attenuation of specific signal components due to this shifting.

You can do better than that, too. Theoretical accuracy of time of arrival distance approximation is directly related to the wavelength of the transmission signal. If you can model the transmitted signal and its transmission path accurately enough that you can get a strong correlation between the received signal and the modified signal (in this case taking into account Doppler effect and wave dispersion), then you can accurately measure both the time of arrival and the phase of the signal. Assuming a perfect model (HA!) the accuracy of the distance calculation is soon dominated by the various noise components (typically your timer noise, power supply noise, decimation noise from your ADC, and various thermal noise sources in both the transmission path and your measurement equipment).
They mean "falling out", right?
TurboTax "is aware of the heartbleed bug."
"Carousel automatically backs up photos and videos to Dropbox as you take them"

Yes, but also:

Dropbox automatically backs up photos and videos to Dropbox as you take them.
Dropbox keeps the history of deleted files just like modified files. Take a look on the web interface and hit the "Show deleted files" trashcan in the icons at the top.

Or for a different view, hit the "Events" link on the left navbar.
Here's an example where Heartbleed is much, much worse.

I run an HTTP-only server that's read-only for the public. However, I have an admin interface that lets me log in and make changes to the site. For example, a WordPress blog.

Now, let's say that I run the server at home and I'm careful only to log in as an admin when on the home LAN. This is perfectly secure even though I'm only using plain HTTP.

If I decided to instead serve HTTPS, the heartbleed vulnerability means that anybody could potentially hijack my sessions, steal my passwords, and edit the site. Depending on how much password reuse is going on, they could own the entire box, or just put malicious code on the site for all my visitors to run into.
Thanks for the feedback! Those three are just the options we chose to start off with, since (a) we weren't sure what users wanted to give and (b) those were the easiest to abstract. We're trying to negotiate with several vendors right now.
Security fixes are usually backported for affected versions, and presumably Colin installed these updates. This depends on the distribution you choose and if you are running a release where they have guaranteed critical updates (i.e. Ubuntu LTS releases).

What you do miss out on is new protocol support, which for TLS can be a huge problem when secure and compatible crypto options run out.

(Sadly, people will usually err on the side of compatibility, which in the past boils down to the terrible RC4)
Well, I've always heard that the primary motivation was navigation, but funny enough, it was specifically navigation for submarines armed with nuclear ballistic missiles. Precise knowledge of the launch location was critical to launching such a missile, and when you're out in the ocean there's not a lot of options.

And why were submarine-launched ballistic missiles so important? Well, to ensure mutually assured destruction, you need to make sure that the first nuclear strike doesn't disable the victim's ability to launch a second strike. You can easily nuke missile silos and airports, but not submarines which are constantly moving. http://en.wikipedia.org/wiki/Nuclear_triad
> unless you check the error return code of practically every statements

Yes, you MUST. That is just how Go does things. If you don't do this, then of course things are going to blow up at runtime. Your "unless" is the same as saying in a language like Java: unless you rescue the exceptions, the program crashes! Yes, clearly.

Personally, I love Go's error handling. I made a joking tweet one time that over 10% of all lines of code in Packer are "if err != nil". That is still probably true, but I don't think its a bad thing.

We also make Serf, which is powering some pretty large infrastructures out there, and we've never ONCE had a crash in production. Not once. We've had errors, but they were logged and handled. I attribute this to the fact that we were forced to handle every error.

Some people like exceptions, but I've always liked Go's way of things in this department.
Funny looking word, but it's not wrong. Fallout is the noun: http://www.merriam-webster.com/dictionary/fallout
it would be better if they had these things linked somewhere customers can find them when new ones are posted

That's a great point. I found it by googling "AWS post mortem", but I only knew it existed because I had been linked to this page before.
Go has no generics. You can either rephrase your program to not need them, or pretend that you're using a less-typed language and write code that can blow up at runtime.
I too, hate the 'new is better' angle. But...

> Rust will not magically solve problems like this.

I agree that it won't magically solve problems like this, but it _will_ solve problems like this. Rust guarantees protection from data races, buffer overflow, stack overflow or access to uninitialized or deallocated memory. At compile time.
Sometimes you don't actually care about the first but still care about the second. In cases like that, HTTPS with heartbleed makes you much worse off than plain HTTP.
Big deal, the internet is made for devices to connect to each other. So what if they are trying to connect?

Tell me when they attempt a DOS or send funky packets.
Whitehat hacker goes too far, gets raided by FBI, tells all
Can't answer for Tarsnap specifically, but older (unaffected) OpenSSL versions are shipped by various distributions that are still supported, for example Ubuntu 10.04 LTS. There's nothing wrong with sticking to LTS releases IMO.
From the link to the OpenSSL vulnerability;

Unfortunately, there's nothing users can do to protect themselves

Um, how about a VPN, or ssh with dynamic forwarding?

I would do something like;

ssh -C -D 8080 -fN user@server.tld

Then it's as simple as setting your web connected applications to use the localhost proxy on port 8080.
I really wish we knew what the site was and it wasn't anonymous. Maybe the post was premature because the author still needs to "fake it till they make it" - but I would imagine that it would be a little bit of good press if nothing else.

Without knowing what the product is though it is hard for folks to compare where they are with this narrative.

For what it's worth I am in almost the exact situation, only I have a product, but its one of those bleeding edge situations that requires a lot of up-front work. So this is a topic very close to home. I just wish I could figure out how similar it is.
For example at Mozilla there are discussions about it, I suspect it's happening for other browsers too:

https://lists.mozilla.org/listinfo/dev-security-policy
Good catch. I'd been using the -f flag while troubleshooting (to speed up the initial connection), but have removed it now.
Sharing izietto's wish, how might one contact you?
This is starting to be a pattern. Although Jony is obviously talented, he sure has driven a lot of talent from the company.

At some point, that leaving talent points to a problem with Jony.

And then it will be Jony's turn.
I agree you with you about generics, but downvoted you anyways, because "it gets ugly fast" is not true. I've certainly felt the pain of wanting generics for some data structures, but I've never felt the pain to where I've needed to make specialized structures for more than 2 or 3 types. And it had no real effect on the rest of my code. It was just one of those things where if I had generics, I could remove the 3x duplication of some code. It definitely doesn't ruin the language.
How cloud computing will save the nonprofit sector
The BS of RFPs:  Why It Won’t Help Your Search For an LA Development Shop
It's funny that #2 on the list uses negative words to say "Don't use negative words." It's almost like negative words can be valuable.
there has to be a better way. the error code checking sounds a little too manual for a modern language imho.
I want to like FlickR so much. I've been a premium member for years but their upload client for more than a few photos at a time is garbage. I also don't like how crude their online organization options are. I know with a bit of polish, it can be the king of ease in interface, but right now I am looking for something a bit more modern. Carousel COULD have been a no-brainer replacement, but I am glad I came here to get the insight of others; while FlickR may do a lot of things wrong, it sounds like Dropbox fails even harder on the organizational scale (root folders?)
And yet, much of the world runs on code developed in languages that don't have them (C etc.)
You're right, I've been fooled by Firebug merging in multiple identical output lines together and missed the (2) it had put on the right hand side of the screen. That makes a lot more sense.
Title's correct: there is no heartbleed in Tarsnap, because the only thing that was using OpenSSL was using an old, unbugged version.

That said, he goes on to claim that even if he had been using a buggy SSL stack, his stunnel setup "keeps the bug away from anything sensitive." But his prior blogpost on the stunnel setup[1] itself acknowledges some limits: "if someone compromises OpenSSL, they will still be ... able to steal the SSL certificate, to be sure, and also able to intercept other HTTPS connections". Meaning, I think, they'd have access to the net traffic in cleartext --- including such goodies as usernames and passwords, which might be shared with other sites.

(Colin might respond, "use a password manager". He very likely does. Most likely, though, a lot of his clients don't.)

So, if they (well, he) had been running a vulnerable OpenSSL, he might still have things to worry about.

[1] http://www.daemonology.net/blog/2009-09-28-securing-https.ht...
Rubocop is great! Hound is built on top of it.

We've tried putting style violations in the build and found there are enough edge cases that it isn't exactly the interaction we've wanted. Sometimes, we want the human to say "no, my pair and I broke the guideline on purpose and we're okay with it in this case." We don't want a broken build in those cases.

Totally agree with you about getting feedback earlier than opening a PR, though. Linters integrated into text editors are a great way to go.
What's up with the rampant downvoting the past week or so? I see all kinds of posts downvoted that shouldn't be (like this one). Seems like it has really taken off the past week or so.

Downvoting is not something you do merely because you disagree. Valuable, intelligent discussion of complex topics that matter requires some disagreement. Downvoting should be saved for comments that are inappropriate in some manner according to the values of the site.
https://groups.google.com/forum/#!msg/golang-nuts/Rj5t1h_ztx...
A colleague of mine always says that you don't have a backup if a single nuke* can take everything away. So even with soft deletion, versioning in itself would not be a backup solution. OTOH, I'd bet Dropbox has distributed backups.

* An exaggeration for natural disasters, wars, lock-downs, fires and so on.
The redesigns probably changed the color of the shift button.
" ...C, a system programming language which could be considered as a niche"

wow

C is now a niche language?

http://langpop.com

http://www.tiobe.com/index.php/content/paperinfo/tpci/index....

etc
In my opinion, it should be a compile error to ignore return values without explicitly throwing them away with _.
"This Is Not a Barbie Doll. This Is an Actual Human Being."
Thanks, though I avoid Google where possible these days.
This problem is like Project Euler #1. You don't strictly need to divide. I prefer to skip along the array and put in the new values.

n,f,b= 100,3,5
a = [str(i) for i in range(1,n+1)]
for i in range(n/f):
a[(i+1)*(f)-1] = 'Fizz'
for i in range(n/b):
a[(i+1)*(b)-1] = 'Buzz'
for i in range(n/(f*b)):
a[(i+1)*(f*b)-1] = 'FizzBuzz'