skysight-inc/HackerNews huggingface dataset:
That's not true. Most websites function fine without javascript.
You'd be forking at the start of the Apache launch before any connections so that shouldn't be much of an issue.

This construct has a much worse bug. It separates the TLS from the rest of apache so it protects against bugs in other parts of the server (HTTP parsing for example) but it doesn't separate the TLS session code from the crypto primitives, so it wouldn't protect against heartbleed. For that forking at the PKCS#11 boundary would be much safer.

Thinking about it a better OpenSSL patch than the Akamai one of protecting the memory with a different alocator would be to run the actual crypto in a different process with a well-defined IPC between that and the main library. That would give you much of the safety of a software HSM without any changes to Apache/nginx or any other TLS server.
thanks. I have upgraded now. Really really thanks for remind!
And crazy eyes, too! [1]

[1] http://postgradproblems.com/wp-content/uploads/2014/02/31c89...
On a legal note;

IANAL, but I did a little research before getting started in lock picking a while back. iirc, there are no federal laws against having picks. However, states often have laws against "possession of burglary tools". In my jurisdiction, if they can establish intent to burglarize -- ie, you're also carrying an empty duffel bag, a crowbar, and a map with the bank circled on it -- its a class II felony.

I repeat; I am not a lawyer.
> Credit card companies charge their customers interest
> if the dispute is resolved against them.

They do that because they can and the don't pay you interest also because they can and you have no leverage against them. Sad but true.
I'd also want a screen to pull down over my mouth to hide my scowl and show a smile.
A really invaluable skill. Picking locks has saved me on multiple occasions, to get into my own property. It has also made me rethink the way I secure my valuable goods. If only for this second reason, I think basic picking skills should be learned by everyone.
Unfortunately there's no way in knowing whether a Python 2 string (str, not unicode) originating from the module should be interpreted as a bytes string or text string. Python 2 doesn't have the clean separation between bytes and strings.

Solutions might include adding some sort of hinting to specify the conversion, or add a Python2-like string class to Python 3, which would pollute its purity.
Unboxing flappy bird, the perfect collision.
It looks like this girl from that fMRI study can use it for entertainment safely. Alongside with a few other tricks with her visual perception. On the other hand, she had mentioned, that as far as the entertainment goes it is not that much fun.

Could be of use though as a modelling environment. Or at least an awesome memory-access hack. Might come at a cost of some other functions though. So I wouldn't feel too bad about not having it. And would suggest to be extremely careful playing with a single copy of an amazing giga-scale peta-synapse neuronetwork that you have.
There are many stretches of road in the Netherlands which are not fitted with lighing at all, mostly sparsly inhabited parts of the country. I've ridden a motorcycle with a less than powerfull headlight on those roads, would've loved this to exist then!
Do small things like code formatting, refactoring, commenting. It helps loading the code back into your brain and get into the flow.
Heartbleed wasn't a remote execution vulnerability. I am not a security expert, but I'm pretty sure that Heartbleed in and of itself wouldn't allow hackers to install a root kit.

In answer to your question, I have no idea how long it takes the bad guys to exploit newly revealed exploits. Probably a day or two on average (for the tools to be developed and then distributed). Also, different people have different agendas and motivations -- there are no doubt people out there desperate to jump on to certain high-profile sites at the first chance (Apple, Amazon, with their credit card data would be an obvious target, for instance), but I suspect most hackers just cast their net far and wide and take whatever they can. Mostly it'll be unpatched servers from years ago that aren't managed by a proper ops team, using exploits that should have been patched a long time ago.
Tell HN: Lois - Golang like channels for Java
Breaking up with Facebook: Where are brands and young users going
The conversational programming idea you pointed to in the other post looks interesting, because a conversation provides information to both the human user and the learning algorithm at the same time.

I always felt that the feedback in supervised machine learning is too far removed from the actual usage of the system. Robotics seems to be the most natural area where this could be improved.
Well the core insight is in there, but it's not highlighted enough:

"The model is very sensitive to the rate of depreciation."

Every TCO model for cars is very sensitive to rate of depreciation, and this rate is very hard to predict. You can rely on historical data only so much - how much in demand will petrol cars be 8 years from now? Diesel? What kind of tax incentives will we get over the next few years? And a single percent difference in depreciation rate can put one car ahead of another.

Within the last 10% or so, it's a crap shoot. And 10% basically puts all cars in the same class within a single bucket. So yeah.
Because that is political reality.

Do you see any armies marching to protect Ukraine's territorial integrity? Russia isn't a small state that can be easily threatened, and nobody in the West has the stomach for a real war. I bet Russia could take all of Ukraine with no response beyond a boycott and some air-strikes.

P.S. The US has done far worse things than what Russia is currently doing in order to keep South America and the Caribbean within their sphere of influence. Small neighbours of great powers seldom get to exercise real independence.
I used a time based token for all my forms. The token becomes invalid after an hour or so. Enough time for legitimate users to post their stuff but completely blocks automatic spam.
There's probably a middle ground here. If you'd taken the time to make sure the patch actually compiled, ran and attempted the things it was advertised to do before releasing it, I suspect problems with it would've been obvious sooner.
I'm in the fortunate position of receiving HBO 6 months for free with my new upgraded digital TV/internet subscription. Only it hasn't been activated yet; I hope I can still see the previous episodes.

But once the free period ends, I don't think I want to keep paying EUR 15 per month for it.
Run away to what? An ad-supported, privacy-undermining browser like Chrome? A constantly outdated and insecure browser like IE? Safari? Don't be ridiculous.
Why jQuery Mobile didn’t success
It's not equality, or inequal results. It's basic needs and inequal rewards.
>proprietary codecs vs vp8

VP8 is proprietary.

I'd appreciate it if downvoters could point me towards the standards body that oversees the VP8 standard. Apparently I just missed the news when it was submitted to an independent standards organisation…

(This debate makes me appreciate how RMS must feel trying to educate people about the difference between free-as-in-beer and free-as-in-freedom)
10 year old Tesla will be considered an ancient, inefficient design nobody will want to buy. Cool factor will be long gone. There will be much better cars and prices will be significantly lower than Tesla's today.
Why use a python script?
Pretty much his entire list is wrong.

"Deploying a commercial website ten years ago required significant upfront capital"

Actually... you could get a very large website up 10 years ago on almost nothing. $30/month dedicated servers were available that could do 10,000 connections at once. Which means you could serve millions of people cheaply. You could also get lots of virtual shared hosts for $5/month or less.

Heck, even 15 years ago you could do that. Maybe not everyone realised it till later, but it's not a new thing at all.

"Startups created simple APIs that abstract away complex back ends. Examples: Stripe (payments), Twilio (communications), Firebase (databases), Sift Science (fraud)."

There were plenty of services around on the internet 15 years ago with APIs too. Including payments, communications, databases, and fraud. I know because I developed some of them.

"Open Source. Open source dominates every level of the software stack, including operating systems (Linux), databases (MySql), web servers (Apache), and programming languages (Python, Ruby). These are not only free but generally also far higher quality than their commercial counterparts."

Guess what? Open source was around 10 years ago.

"Programming languages. Developers have steadily marched upwards from Assembly to C to Java to, today, scripting languages like Ruby and Python. Moore’s Law gave us excess computing resources. We spent it making developers more effective."

Ruby and Python were both around ten years ago. The same as perl, php, and haskell amongst others.

"Special-purpose tools for non-programmers. These tools let non-programmers create software in certain pre-defined categories, thereby lowering costs and reducing the demand for developers. Examples: Shopify (e-commerce), WordPress (blogging), and Weebly (small business websites)."

um... blogging, e-commerce, and lots of other non-programmer tools were around in the 90s.

"General-purpose tools for non-programmers. In the pre-Internet era, tools like Hypercard and Visual Basic allowed hundreds of millions of semi-technical people to become software developers. Since then, there hasn’t been much work in these areas, but from what I’ve seen that might change soon. By allowing more people to program, these tools act as a force multiplier for the software industry."

Have you heard of the internet? Seen the reams of cut and paste code out there from semi-technical people? Whole industries are centered around letting less skilled people make software. This hasn't decreased, but increased. There's a whole "everyone should code" movement hitting us.

Is this the quality of article we want on this website? Please delete my account!? I'm done.
The lack of interest in pushing Persona forward has made me wildly change my stance on Mozilla. Third party authentication is an important building block of the web which is currently dominated and virtually owned by Google and Facebook.

Persona does everything right, yet it is not being pushed forward anymore; I have my doubt as to whether it ever was. In "keeping the web open", it is such a low hanging fruit I simply don't understand the complete disinterest behind Persona - is Mozilla just waiting to see if a protocol with a cuter name comes along?
As much as I identify with the motivations behind this post, it's utterly out of touch. The author complains about the realities of ad-supported business when the truth is that the for-pay browser market died out over a decade ago because it simply was not a sustainable way to operate a business. Even if Microsoft hadn't begun giving IE away for free, someone else would have eventually - they'd swoop in with their VC money, demolish the browser market entirely with a pricing race-to-the-bottom, and then explode like all startups do and leave us screwed. At least when Microsoft did this, they kept shipping their browser afterwards (other than that IE development pause... sigh.)

Ideas like intentionally fragmenting the userbase (with some absurd idea like 'PrivateFox') merely contribute to the issues he highlights; if revenue to fund development is scarce, why would you actively undermine your revenue base and waste resources on the product that is destroying your revenue? It's absurd, no sane organizational leader - moral imperative or not - would ever do this. Mozilla cannot do this.

Hypothetical revenue sources like crowdfunding and intentcasting are great, but it would be utterly irrational for Mozilla to switch wholesale to some new unproven revenue model. Even if it works for a while, eventually they run the risk of scorching the earth (like how Zynga and co completely obliterated viral pathways on Facebook, effectively destroying their revenue streams).

If you want Mozilla to adopt a new business model, you'll need to find a new business model that will actually work at their scale, then prove it works. They can't afford to undermine their extremely important efforts (on Firefox, etc.) just to satisfy your curiosity and desires for an ideal world.
Team Management App Weekdone Now Reports To Android
It's pretty slow at checking for new versions, though. I get the impression that's because of the way they seem to scan your disk (it seems to be a brute force "scan every directory on the disk looking for .exe files"). Also, it's fairly common for it to flag your version as out of date and then be unable to automatically update it (although it provides you a handy link to either fetch the setup your self).

That said, it's handy to have a centralised point to check for updates.
"In May 2010, after the purchase of On2 Technologies, Google provided an irrevocable patent promise on its patents for implementing the VP8 format, and released a specification of the format under the Creative Commons Attribution 3.0 license.[6] That same year, Google also released libvpx, the reference implementation of VP8, under a BSD license.[7]"
They pushed Persona pretty hard (and integrated it into their properties) for quite a while. Nobody cared; everyone prefers privacy-compromising login services like Facebook Login. The battle's lost.
* Not a week goes by without news about some tool that finally allows everyone to create UIs easily *

That's because they start at the easy part (the UI) and move down until they hit that this is a hard problem. But there's reason for hope: there are breakthroughs happening in this space (reactive like spreadsheets, declarative like SQL). The results are really exciting.
A better credit rating system - I think that's coming and we won't like it.

Credit scoring is basically data collection/mining and statistical prediction. With all the new data sources available today, it's hard to think that won't result in a major disruption. But…

(1) Credit agencies' customers are creditors, not borrowers. A good service is not necessarily a fair one, just a statistically correct one. I think we may find an increasing, not decreasing disparity between fair an useful (to creditors) service. Paying an unfair bill on time may even be a better predictor of your likelihood of paying bills than paying a fair one.

(2) The creepier (what data is collected & used) and more unfair (your parents defaulted on..) things get, the more shadowy the biz is likely to get. At least credit score is relatively accessible.
I am really looking forward for such a read about North Korea in some years. I hope I live long enough to see it.
This is a dupe of https://news.ycombinator.com/item?id=7500573.
Presumably then the issue is more about carrying them with you when you're out and about rather than having them in a toolbox at home?

In the same way you can have a big knife at home but carrying it in your bag is a problem.
I just got the mail , exactly what I was looking for, all they need to add is the same results in the web interface and the ability to play with it.
--
Is there a way to edit one's comment ?
There is a new movement to use Bitcoin nodes to greatly increase the speed of Tor. Its called Toroken. It was just announced this week: http://www.dailydot.com/technology/toroken-tor-bitcoin-anony...
If you turn off javascript, most sites become at best read-only. A good chunk don't work at all or partially break in ways that make the site unusable even for viewing (e.g. flickr).

I'm trying to think of sites of that degrade nicely. I can only really think of HN and gmail.
Funny thing but my only real life experience of lock picking and none of those techniques were used. It was a combination lock with 4 wheels and it was easy to figure out the combination with a little piece of plastic wedged between each wheel and the lock face.
exactly. if access to a CA is blocked it is not good and I want a big red warning sign in my browser. what chrome is doing with their high profile website revocation by browser update is all bullshit.
The idea behind qubes is to use the security properties of virtualization layers to enable a secure , easy to use system. Given that virtualization layers are relatively small ,code wise ,that's a good place to start.

Given that amazon uses xen in the EC2 platform(as many others), we're not only talking only about "worldwide collection of software engineers " but also of some serious commercial interests in it's security.

And XEN might not be the end point of that approach. There has been some research on formally verified hypervisors.While it's not 100% foolproof since you still have to depend on hardware security, which is a unknown(does intel cooperate with NSA?), that could give great assurances for system security.
Have you seen http://rbutr.com/?

It's aiming to do a lot of what you're looking for.
In case I accidentally forget about the newly created notify-list you can follow me at @jontelang. I rarely post so I won't be any clutter. ^
Creepy Facebook – Clear Your Search History
the revocation check cannot easily get bypassed. if you block the Ca, then the check should definitely fail. this is not the same as saying it is bypassed.
Heartbleed fix – OpenSSL
What is ridiculous about Safari?
Why C++ for Unreal 4
Gists are an easy way to work with small bits of code without creating a fully fledged repo

What is the disadvantage of working with a "fully fledged repo"? Gists unecessarily fragment git workflows. For example, how do I convert my work (a git repo like all projects) into a gist? gists should have been designed as an alternative way of viewing repos, not as a slightly different species of repo.
Why does most of the world continue to use the pin tumbler locks, when the disc tumbler lock (invented in 1907) is almost impossible to pick?

http://en.wikipedia.org/wiki/Pin_tumbler_lock

http://en.wikipedia.org/wiki/Disc_tumbler_lock
Thank you for thinking about and alleviating the memory usage problems. Firefox has seriously improved in this regard and now runs decently even with pathological numbers of open tabs (Yeah, I know.).
So you're not even vaguely concerned about the privacy implications of telling the CA about every HTTPS connection you make?

You don't care that if the CA goes down then the entire encrypted web stops working?

Think.
I am the author of Javelin Browser (javelinbrowser.com , for Android), and I think I founded a business model (that works) that is entirely opposite of Firefox's and Chrome's, VPN services. In fact, Javelin is so pro-consumer that it has Ad-Block built-in.

In less than a month, I'm edging close to 50k downloads with a good retention rate (installed users), and with revenue coming in from Pro accounts and VPN subscriptions.

The long term plan is to grab the market share by focusing on a Pro-Consumer experience, all whilst enabling a better secure and decentralised internet.
I didn't know before that someone can scrape or access HN's API to retrieve it contents. Is is actually legal?

I'm so fascinated by the news here that I haven't yet figured out how the site works so far.
Who reads a car manual?

If you want to continue that, you could consider the manual to be about:config. No one is stopping you from reading the manual or going to about:config, but it's not required.
Best guess? Pin tumbler locks are probably cheaper to produce.
Sure? http://www.ukbumpkeys.com/products/disc-tumbler-picks
I don't think C should be blamed for the HeartBleed bug. Please see http://www.pixelstech.net/article/1397465547-HeartBleed%3A-S...
But the op wrote "going from zero" which makes it different from your journey. Of course no one can refute your story, but ime that quick progress is very uncommon. It's the computing worlds equivalent of "bought a guitar six months ago and now I'm signed to a record label!"
Sounds like you need to modularise the problem more, which you are naturally forced to do by the limitations of spreadsheet "programming".
I can't seem to find any command line tool (including openssl s_client) that will automatically "do the right thing". Curl, wget, w3m and lynx and "openssl s_client -connect revoked.grc.com:433" all happily connect without warning.

So much for downloading install scripts over ssl...
> there are breakthroughs happening in this space

could you elaborate on this one. Any links?
Yeah the userbase has spoken - they don't want Persona. People prefer what they know i.e. Twitter/Google/Facebook login.

Business also prefer Twitter/Facebook/Google login, because they can get more info this way.
xen is over 100k lines of code, not counting the kind of interfaces software exposes using its APIs, and stuff like drivers.

its not small
This is one REPL, and compiler, that does not work and doesn't react to user interaction. That doesn't exactly inspire confidence.
That's why I stopped using NoScript long ago. Things should just work, and NoScript doesn't let things just work. It'd be good if it had a list or something, but I have no clue what it would actually block/allow, since that's specific to the user's purpose.
I'm with sleepyhead - what exactly is wrong with Safari? I'm a web developer and I use Safari almost exclusively. Hardware-accelerated (on OSX, anyway), good performance, accurate rendering, no privacy intrusions.
Great initiative.

* Someway to re-introduce photos into cabins' visitors books.

In Norway, all cabins have their own visitors book. Until the mid-'00s these books were filled with physical photographs. With digital cameras, the images in these books have disappeared, and there has not yet been invented a way of attaching digital albums to each trip/chapter/page. (Social networks doesn't do the work, as a lot of people who aren't connected to each other read these books.)

The people who writes about their cabin trip need somewhere to upload the images from their stay, and the people reading the book need someway to see these photos.
I like this idea a lot, thank you for sharing it. I might try this with http://hikigo.com. Like most things it might be hard to get the initial core of users.

What I liked about the parent post is: It still wouldn't ever get as big as Reddit. When you find yourself thinking that way, you are probably onto something you actually want.
Well as a developer it's easier to just assume JavaScript will be there. For example, imagine playing a game in a browser without JavaScript (yeah CSS can come close, but not close enough for my liking).
See I don't think coding can get any easier for the level of problem we are talking about here. The kind of small problems we seem to be talking about are the kind of thing that is within the realm of "scripting". You don't need a deep understanding of Computer Science or advanced data structures to write good enough code for those problems.

"Coding" will never go away before AI because at some point you need to formally express the design you have thought up. It doesn't really matter if you do that with arcane syntax, symbols, or "natural" language.
"PaX is a patch for the Linux kernel that implements least privilege protections for memory pages. The least-privilege approach allows computer programs to do only what they have to do in order to be able to execute properly, and nothing more. PaX was first released in 2000." [1]

[1] http://en.wikipedia.org/wiki/PaX
"Stores sharing shoppers’ faces" – networked blacklisting come to life
I enjoy the challenge of figuring out how to disable some parts of site. It's a trial and error affair, but very interesting sometimes. It helps you realize how sites are built.

It's not for faint of heart though.
IE is outdated and insecure? IE6 - IE8 could have that label applied but IE9 - IE11 have incorporated major web standards, are quite fast, and have closed many security holes. At least you gave reasons for swiping at IE, what's up with Safari?