skysight-inc/HackerNews huggingface dataset:
It really depends on the message. e.g., this morning I had to tell my wife that her dog died; there's no easy way to do that. About all I can say about that kind of bad news is that it should be delivered in person.

OTOH, when terminating a contract (the only kind of "firing" I've ever had to do), I point out to the contractor that they did great work, and was well appreciated and they have completed their services well and the skills are no longer needed. Follow up by mentioning that I would recommend them for a new position and they can finish out the week.

Crappy contractor: you're not working out. We have to terminate now.
Because you either have to decide on a number, or else implement automatic wrapping, and automatic wrapping can be bad for a number of reasons (which I won't get into here).

As long as you decide on a number, you want to pick something that is wide enough to be useful, but small enough that it doesn't lend itself to abuse (overly long variable names, 8 levels of indentation, and so on).

Also, it's nice to be able to look at two or three columns of code in a reasonable font size on your monitor, to view it in websites of normal width, and so on. And to know that you can still view code just fine on your 11" Macbook Air, even with a project-tree sidebar open in your editor.

For legibility, typeset columns are often recommended to contain something around 60 characters per line, although there's clearly a range. [1] Because code is often indented 1-4 levels (unlike normal text), it makes sense to expand this somewhat, and 80 is a nice round number for this.

So, 80 is probably the most common number I've seen for code line length, and there's absolutely nothing cargo-cult about it. It's simply that, if you don't want to implement line-wrapping, you need to pick something, and 80 is quite reasonable.

[1] http://en.wikipedia.org/wiki/Column_(typography)
Why should revocations cost money?
Yes. No question.
Some of the pain points I've seen:

* while "go get" is nice, it doesn't handle version pinning at all. So for a large team working on a go program, you need another solution. Luckily there are tools like godep[0] that will allow version pinning and putting it's source code into your projects root.

* debuggers (gdb) are only partially supported. Most people don't have problems with this, but occasionally it's an issue.

* Windows support is not as strong as Linux and OSX. But it still works surprisingly well.

[0] https://github.com/tools/godep
500 years of typographical practice has shown our species that 80 characters is about as long as a line can be before it becomes difficult to read. To see this, take a novel from your bookshelf and count the characters per line.
"The machine does not need to affirm its lower status. It's a machine."

I think many 'normal' users need frequent reminders about that lower status. Many users, when confronted with a message such as "could not find file 'foo'", will feel that that is their fault.
Shameless plug: http://www.nubisio.com. Our pricing is capacity based, so you can have as many users as you want, and our product (CloudStorm) supports all major cloud providers.
That's precisely why you only use subkeys in daily life and only use the root key for keysigning (and ideally store it safely and offline).
This is old news. Slashdot even did a story about this long ago. It seems every couple years someone finds this and makes a mountain out of a mole hill. If you're connected to the internet expect all kinds of random packets to be tossed your way.
JavaScript Primer For Meteor
That's pretty rad. Is the source available anywhere? I'd like to see something like this for Sublime.
They absolutely do. They have a social responsibility as long as they are on the list of CAs trusted by browsers.
I'm not sure what Slashdot actually is anymore. The titles of the entries appear interesting at first, but when you read the associated articles, any substantive content seems to vanish into thin air.

I'm still interested, it's just not that interesting.
XSS vulnerability found on shop.airtel.com
How many? I can only 11 comments in total right now.
I don't understand what advantage this has over just doing:
ssh -D8080 username@server.name

Also does spiped natively act as a socks proxy? I was under the impression all it did was handle an encrypted stream of data from one socket to another.
https://github.com/bbatsov/rubocop
Digital Marketing Consolidation is not Inevitable
I think I only find apologies strange when they come from devices I consider to be an extension of my own agency, rather than an emissary for someone else's. If a vending machine apologizes for being out of stock, that's the vending-machine company doing the apologizing. But if my Windows PC says sorry, that's not Microsoft apologizing to me; that's effectively me apologizing to myself.
Debian squeeze (oldstable) is not vulnerable, because it's still running 0.9.8o-4squeeze14.

0.9.8o was released 2010-06-01, almost 4 years ago!
Seems to be up again. Mine is fine, and the status page says they are monitoring.
Yeah, that is the real question I have about SSD; I mean, normally you want to buy enough ram to cache all the data you regularly access, because the overhead of hitting spinning disk absolutely kills you.

Now, SSD is still slower than ram... way slower than ram. But it's way faster than spinning disk, especially on reads. I imagine there are some applications where SSD is fast enough that hitting disk is okay; you don't need to worry about having enough ram to cache all data you might read, and ram is still like eight or nine bucks a gig (vs. $0.6 to $2 for mlc ssd) - and if we're talking about reads here? MLC is fine for reads.

Of course, part of that ram difference might be that ram prices haven't fallen much over the last year or two, (in fact, most of the ram I bought last year, I bought at a lower price than the ram I'm looking at now.) while SSD prices have really fallen fast, so I don't know if this is the long-term price-equilibrium; still, I would expect ssd to continue to be significantly less expensive than ram.
And has a history of upgrades since 2003.

https://blog.linode.com/category/upgrades/page/3/
In general I hate arguments that includes the grannies and grandpas of our world.

First of all because it makes the assumption that all of them are stupid somehow - or for the less adaptable ones that have problems with newer technology, it makes the assumption that the current status quo works. Do you think that granny from your example wouldn't click "Ignore" on a browser warning?

Second of all, if we really get down to an argument about elders, society and making the world a better place, the priority shouldn't be to keep the status quo because the elders wouldn't cope with change - because in that equation, today's children are more important, don't you think?

> Have fun explaining to her that she needs to exchange keys with enough trusted intermediaries to have a valid trust path to her bank

That's false - she only needs to exchange keys with the bank directly.
How a non-tech, thirty-something with kids started his company
NSS is more complicated, for a lot of reasons. As I recall, it handles its own keystore which it doesn't share with other implementations (e.g. the ca-certificates package in Ubuntu/Debian); it requires you to initialize the keystore manually and teardown when you're done, but sometimes you don't know if anything else has done the initialization, so you don't know if it's safe for you to tear it down.

There are other issues as well; not blocking problems necessarily, but reasons why it might not be a great implementation or why it would break the way current SSL works for distro maintainers and users.
Why use the -f switch:

-f Use fast/weak handshaking: This reduces the CPU time spent in the
initial connection setup, at the expense of losing perfect forward
secrecy.
Same way it works in Java: by convention. You use the repository URL on e.g., github in the package name, so if that URL is unique then your package name is unique.

It rather relies on the assumption that you do have one unique canonical URL associated with your package for this to work, but one of the things about go is that a lot of it is based on pragmatic assumptions that turn out to be true often enough that the edge cases don't matter.

If you use go get, it can auto-download any such publicly hosted packages, which is a nice feature, especially as it can get the dependencies for you as well.
Well, the arguments in the thread so far aside, I thought the reminder that being determined was important.

When you're sitting around in a room at 3AM in the morning in front of the glow of a monitor slaving away on code with no paycheck in sight, random inspirational tidbits on the internet make a difference -- particularly from people on the side of success. Even with funding, sometimes those 3AM silent moments can be scary.
Related: "Ant Colony Optimization" by Dorigo and Stutzle. They also provide sample code in C.
I think elegant is probably the wrong word. Practical is the one I would use. Go isn't Haskell; it isn't there to impress the PL guys. They boiled down the average imperative language and made many decisions for you so that opinions don't have to collide while working on a project. Because the decisions they made, they have very nice tooling to go along with the language.
The fully-qualified package name, by convention, includes the web path to its repository, for example: `github.com/smartystreets/go-aws-auth` is unique.
WOW, Awesome Documentation and Product!! Kudos and Greetings from Germany 😊

Those who know what Hadoop, Pig and the whole "Data Science Stack" is, will find this surely useful.
Not only that, but any attempt to hijack Google Mail connections in the large will run aground on Chrome and Firefox users, who will not only not accept the rogue certificates, but will also alert Google, which will put a gun to the head of the CA.

This is one of those "Things which somebody would probably bring up at an anti-trust meeting if anybody at an anti-trust meeting had the foggiest clue of what was going on", incidentally. (The hypothetical threat is "You give our web properties a better SLA than anyone else in the world gets, or we will use the coincidental fact that a large portion of the world's web traffic runs code under our control to end you.")

It's funny, people (including me) always thought that Google's big swinging Wand of Annihilation was google.com, but now they have at least four of them.
For arbitrarily many colors, use the golden ratio:

http://martin.ankerl.com/2009/12/09/how-to-create-random-col...
SHOTS FIRED – MALE WANTED – C14-70183
Ants also have a risk-management algorithm and can be compared to businesses. Their business model is to send ants out of the nest and bring back calories, water and protein. These resources are then turned into more ants.

In the most ideal case, this is an exponential growth curve. But "investing" in a new food source, meaning to send out a fraction of the capital to get more revenue, is also risky. There are predators, rain and heat. Would be tough luck on a colony, if they send out half the ants at the same time and then some hungry predator just feeds off the ant street.

So the ants do have some sort of risk management algorithm. I don't know how it works completely, but essentially the decision to send out workers is influenced by the amount of workers in the nest and the frequency of ants coming back with a "profit".

As with any well managed portfolio and a little bit of luck, the growth curve then is exponential, while not exactly crazy, and the end result after a few years is a prosperous colony, having accumulated so much capital, that they don't know how to spend it on growing themselves.

That's when they start to spawn a new generation of ant queens, which is a horrendously wasteful and expensive exercise, but all of these newly mated ant queens, if she survives the first few days, will go into stealth-mode and found her own startup colony.
does spiped natively act as a socks proxy

No, it manages an arbitrary number of streams of encrypted data, but all it does is push bits (and encrypt/decrypt, of course).
Show HN: Deckset for Mac – Turn markdown into beautiful presentations
What do you mean? Why do you feel this way?
Could Bitcoin ever overtake the dollar?
Here's one in Hy (a homoiconic frontend to Python... it really is just Python™):

(require hy.contrib.anaphoric)

(ap-each (range 1 101)
(print (cond [(= (% it 15) 0) "Fizzbuzz"]
[(= (% it 5) 0) "Buzz"]
[(= (% it 3) 0) "Fizz"]
[True it])))

Reads pretty good too, doesn't it?

http://docs.hylang.org/en/latest/
Surely systems programming is more popular than web? As you need a system to access the web, but not every system accesses the web...?

What can I do in Rails that I can't do in PHP?
Maybe he wants perfect forward secrecy?

EDIT: I read the question backwards.
I think you're right, but it's definitely the outside perception that something is odd about SV in this respect, and relatively trivial products can get blown out of all proportion there.

For me it was Cover, that Android launcher, that caused the confusion. The value of that is not in being able to develop it, because that aspect of it was trivial, but having the idea to do it, the vision to see it's possible, and the connections to get PR to get visibility for that in SV seems much more valuable than "just" the ability to execute. I think the surprising factor is just how valuable those intangibles can be judged to be. (Not saying they're not valuable, as they clearly are, but it's interesting just how much the VC market thinks they're worth, amplified by the effect if you happen to be in SV).
Unless you unload old images after you've already scrolled past them, in which case it works fine.
NSS. Now, back to my question?
In college our underwater acoustics prof used an old copy of the Navy sonar manual to teach some fundamental concepts early on in the course. One of my favourite passages was when the Navy manual definitively answers the question of "if a tree falls in the forest and nobody's around to hear it, does it make a sound?" The answer, according to the Navy is that no - in order for a sound to exist there must be both a transmitter and a receiver component, and if both are not present then the energy emitted by the lone transmitter does not constitute "sound."

So, according to that - you're both right in that it's a two party process. However, I believe the term is appropriate in underwater acoustics for anything which dumbly sends out a relatively predictable signal on a regular interval.
Using split window panes allows me to see more on one screen, without switching contexts (tabs).
That's because C++ is an approximate superset of C, an so it inherits all of that baggage as well. This is why we need new systems programming languages like Rust, designed for the 21st century with the benefit of hindsight.
Heartbleed fallout: Expect more spam and phishing attempts
This is a plus to distributing your own app...you can just bundle the public key(s) for your servers with the app and then there's never any reason to verify through CAs or any such nonsense.

Although in Tarsnap's case, an SSL leak wouldn't be terrible because everything's encrypted before even going over the wire, at least to my understanding.
The responses to this issue appear to fall into two groups: The first group doesn't care, and the second group is apoplectic but is unable (or unwilling) to explain why.
SMTP Service Crash Course
It won't work on py3 because map is a generator. Tell him to use list comprehensions:

[setattr(self, x, kwargs[x]) for x in kwargs.keys()]

Though of course that is a bit too slow and he should do

self.__dict__.update(**kwargs)

or for maximum correctness

import os; os.remove(__file__)
Also the criminal justice system doesn't accommodate evidence obtained through the NSA's methods.
This tactic has probably blocked a million bot posts over the years, so I guess... Sorry... But not really sorry?
Are there any advantages over something like sshuttle? [0]

Doing sshuttle --dns 0/0 seems more convinient especially since a regular sshd on my box is all I need, no additional software. And it instantly tunnels all my traffic, no need to configure socks proxies. It also avoids TCP-over-TCP which it seems like you're doing?

[0] https://github.com/apenwarr/sshuttle
If that's the sole use-case of having an error ID, then the error dialog should probably just embed a web browser with search results, to save you a step.
Anybody know which, if any, of the SSL cert vendors don't use OpenSSL?
I don't normally comment on grammar issues, but I just can't get your use of the word "ingenuous" out of my head.

My first thought was that you meant disingenuous. And that makes sense in the context of your sentence.

But then I checked if ingenuous is even a word... and it is: "showing innocent or childlike simplicity and candidness" or " lacking craft or subtlety". And those sort of work in the context of the sentence too.

So either it was a typo, a misunderstanding of english word formation, a brain fart, or an intentional use of an uncommon word by someone far more articulate than I.
There are posers of course, and people with other issues, but in general I've found folks to be pretty honest. What a lot of people miss though is that it takes time.

There is definitely an inverse power log sort of thing where the number of people who have gone right from college into startup success is really small, and the number of people who have gone from school to startup success in 10 years is pretty large.

A typical trajectory seems to be move here working for some current 'big' tech company. Build a network of the cool people there and figure out where you eventually want to live, then show your stuff at BigCorp while people who have been there longer start peeling off. Most people know who are the 'good' people and who are the not so good people at their previous employment, if they have you in the 'good' category and they've gone off to do a startup you find interesting, you can often follow them there. Then get your feet wet in a startup early employee to exit (death, buyout, what haveyou). During that time you get known by the VCs in the company and your peers there, perhaps you recruit people. You prove you can be effective in a small environment. Then using your connections with investors or other people you've met you go in as a really early group of already more seasoned people, which ideally has a solid outcome, and at that point 10 - 12 years have your graduation from school you are ready to start your own thing. The graphs in this chart [1] match my experience. People doing a lot of the founding are in their 30's.

Up until you're the founder though, success or failure is rarely on you, its on the founders. And even then depending on how it failed well that can actually be a positive if it was shooting for the stars and only making it to the outskirts of the solar system.
Until they lie about how they got it.

http://en.wikipedia.org/wiki/Parallel_construction
For anyone else interested in the protocols that tarsnap uses - https://www.tarsnap.com/crypto.html
So, I've managed to obtain private keys from a test copy of Apache on Linux - very unreliably but it works sometimes - and I can't actually seem to get it to work at all with a freshly-started Apache. As far as I can tell, there actually needs to be a certain amount of prior heap activity before the attack stands a chance of working. Whilst I haven't analyzed exactly what happens, this particular attack is intended to look for keys in the format OpenSSL uses to store them permanently in RAM.
>Just because someone doesn't program properly

It isn't just accidental errors you need to worry about. Obfuscated intentional errors are a problem too. If the language design prevents bugs that an NSA mole would try to slip in, then that is a very good reason to rewrite in a new language.
I thought adding `-f` meant that you lost PFS?
I'm no security expert, so this is an honest question.

Why was Tarsnap running a version of OpenSSL that's at least two years old^1 ? My understanding is that, while you might not want to upgrade immediately upon release (because there may be new bugs), neither should you never upgrade (because releases fix old bugs).

Is it because the website itself doesn't do much -- it's not the business; backup is -- so not much time is put into it?

[1] OpenSSL 1.0.1, the first version of OpenSSL with the bug, was released in March 2012: http://heartbleed.com/
I'll be giving a workshop on using GHC iOS at BayHac 2014 [1] along with a demo of http://tree.is which is built entirely on top of it!

[1] http://www.haskell.org/haskellwiki/BayHac2014
I don't understand all the huff on that forum about this. It pings to see if you have some ports open. So what?
The Next True Platform is Mobile Messaging. And Facebook Knows It.
U.S. Navy's Robot Helicopter Delivers Military Supplies via Tablet
This is a bad analogy, because you are the only user of your house. This doesn't just affect the site owner, but their users as well.
TACK is really cool, but is it still pushed to the vendors? (Or even, are the vendors interested?). I've seen patches floating on github, but alas, not that much activity lately.
Which is why, during the Cold War, the US maintained very powerful long wave transmitters, both land-based and airborne. Using VLF†, they could send the nuclear launch codes to the nuclear missile submarines without the subs having to break the surface and create a possible radar return.

They kept an airplane aloft 24 hours a day carrying a SAC general. In the event of war, it could reel out a long-wire antenna a couple of miles long from its tail and send out the codes.

†http://en.wikipedia.org/wiki/Communication_with_submarines#V...
Of course they're not "all knowing", but this is a poor argument - if they were all knowing, would we expect them to put "all criminals in jail"?
> OP has never heard of panic() and recover(), which are awful things that should not exist.

OP is using panic in the Heartbleed script he wrote. Source highlighted here: https://github.com/FiloSottile/Heartbleed/blob/master/bleed/...
This is why the description is good.

Sure, it tests whether you can write a set of statements a computer can understand.

But it also tests whether you can understand the intent behind a set of statements a human would make, without going on a diatribe about how the definition is not good enough.

After all, if English was a formal strict language where only one right way existed to express something, we wouldn't need programmers, would we?
Temporary for now. I don't want a CA who has a "you can't trust them for up to a year after a vulnerability" to be in the default trusted list.
> I don't understand what advantage this has over just doing: ssh -D8080 username@server.name

I used to do precisely that, but I think spiped has two major advantages:

1. It is more resilient on a flaky connection.

2. I trust the security of its codebase more than SSH, both due to its smaller footprint and cperciva's reputation.
Customers are idiots. To wit:

"If I had asked people what they wanted, they would have said faster horses." -- Henry Ford
The parent wasn't saying code should be short, they were saying the syntax for lambdas should be short.

Yes, short code doesn't automatically translate to readible code. But neither does long code.

You can't wheel out objective-c's fondness for long self-documenting message names as self-evident proof that the syntax for lambdas must be verbose.

Long message names are good because they let you clearly describe what is otherwise a big black box of unknown behaviour.

The syntax for a lambda will always be a lambda, so it doesn't need to be spelt out explicitly each time. Shorter syntaxes such as used by Haskell are easier to visually pattern match on and so can actually aid comprehension.

It's not as simple as longer is always better and anyone who disagrees is obviously foolish and lazy.