skysight-inc/HackerNews huggingface dataset:
While the core parts of the crypto algorithms are, to some extent, intrinsically messy, that doesn't have much to do with the specific complaints here: inconsistent error return codes, pseudorandom indentation, #ifdef and if(0) stuff which deeply obscures control flow, and so forth. All of that is just bad style.
Looks good! On the FAQ, it mentions that power is via a 2.1mm barrel jack, & US adapter is included. Do you have plans for a USB powered version?
My Heart Bleeds for OpenSSL
I didn't realize that anyone still used loadbalancers without liveness testing (a superset of this capability), let alone with this capability.
inertia, it's what people know and too few people know it's internals to care.

if every google search for "https apache" comes back with openssl examples, it will be what's deployed.

personally I use gnutls for my irc servers, but, I'm the exception there. Those in the security community openly mock openssl due to the fact that it was a boys method of learning how SSL worked, which has been adopted but never properly structured...

.. or that the 'openssl' command itself is actually supposed to be for development only.
What kind of things do people use D for? If there was an ARM compiler I'd use it for embedded work in a (bounds-checked!) heartbeat.
The Gender Pay Gap is a Complete Myth
Fix Patents
It's true that first-come-first-served isn't optimal, but at least it's not as brazenly monstrous as turning away people whose need is just as great because they can't afford to line your pockets as thoroughly. Limiting the amount per customer has a lot of potential, though.

You're also assuming that profit-gouged emergency supplies are necessarily limited. If the local water supply has failed after a hurricane, and you've got enough bottled water to comfortably supply your community, you've still got a captive audience; you can maximize your profits by forcing them to empty their wallets to survive, if you're an asshole.
A little known fact: If you have a Brazilian domain, you have free DNS at Registro.br, the official country register.

I stopped to use dyndns since they started doing it some years ago. The interface is a lot better, and you will have quicker responses for your Brazilian visitors.
Cost Explorer for AWS
This phenomenon shows me that our brains must be wired to ignore quite a bit of clutter until we have a reason to consider it interesting.
I am having a lot of trouble figuring out what you were attempting to convey in the first four sentences in your comment.

The one thing that I can discern is that you printed a list of every package that depends on libssl1.0.0 for your configured repositories. But you have no idea if those programs make use of heartbeat. ssh (and everything related like libpam-ssh) is on that list and does not use TLS. The same can be said for many others such as tpm-tools, ntp/ntpdate/openntpd, xca and so on.
Did you do a 301 redirect?
I think it's largely a problem with OpenSSL itself.

It's true that TLS and X.509 are quite complicated and I think it would be a challenge for anyone to implement them correctly, but that doesn't explain even half of OpenSSL's awfulness. Having consistent naming and error handling conventions should be possible regardless of how complicated the standards are. Plus, their crypto library is awful too, despite not having to deal with TLS or X.509.
I think the fault is mostly mine for not reading closely enough, but that is helpful of you to rephrase anyway.
It's newer than Jira
My New OKCupid Profile
The name expresses the intent very well, does it not?
Academia - where the competition is so brutal, because the stakes are so small.
At first glance it seems to be the same as Heroku's Preboot functionality.

Heroku docs: https://devcenter.heroku.com/articles/labs-preboot
http://www.yassl.com/yaSSL/Home.html
Possible the AWS Web console could be affected.
Star Trek 1971 Text Game (2008)
The thing that is being called "front running" here involves multiple exchanges. There is no cutting in any single line. There is more then one line, and you can be in multiple simultaneously. In some cases, traders may go through one line and then complain that HFT traders went and got in the other line. In order to call that "cutting in line" and be well founded, you need to come up with some framework for how that "line" works - it does not fall trivially out of the actual lines in the two exchanges.
The question seems so absurd that I'm assuming OP meant publishing personal repos to the company's GitHub account.
I would be very glad if it did not give me the "unbecoming-woman" nickname. Other than that, demo seems very cool, appreciated.
"A rational economic point of view" means that you value your personal cash flow (including factors like long-term customer goodwill, admittedly) over other concerns, which is what I already said. If someone gives you a magic button that kills one random stranger and then turns into a $100 bill, the rational economic decision is to press it. You're not scoring any points here.
Smile:  a programming language based on Lisp and Smalltalk
To be fair, the first impression of a job seeking related site should come of as professional, minor design quirks (even stuff like font errors from minor CSS mishaps) can be a thumb in the eye. Valid points and the authors seem to appreciate the feedback.

And there are quite a few non-design related comments as well.
OK, I am sold. This is such a cool demo; I couldn't NOT buy this thing.
If your only justification for calling someone a racist is "but sometimes racists use that word!", you need to spend less time on Tumblr.
Would you trust visiting a site that's just HTTP?

Self signed certs for unknown sites are fine. There is zero problem visiting them.
Depending on your needs, but you can check:

https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementati...
F5 :P
Hey, since you can write all that, where is your portfolio? Show your github.

Don't have a portfolio? Build one.

Mike Ross could read along with a text book that he had memorized. If you embody any aspect of him, it's the arrogance he holds to throughout the series, the idea that his gift means he shouldn't be beholden to the expectations of others.

Because that is how you come across. Arrogant, without any reason to be.

The good programmers let their work speak for them a lot more... they know you don't tell somebody you are good, you show them.

Also you should know that your numerous typos do detract from your claimed intelligence. Programming is one place where typos REALLY matter.
Nicknames are random. I apologize on behalf of our server.
Just curious, did you ever try MJPEG to node.js? I was trying to build something similar with really low latency streaming. Came to the same conclusions about the available services.

Got my latency down to < 1s (same city) with an IP cam with built-in MJPEG stream, served by node.js as an ever updating static jpg. On the client side I then used a simple requestAnimationFrame-script to update the image source as often as the client would allow.
I'm definitely left handed, but I don't think visually very well. I do prefer brainstorming with diagrams, but I need to draw it out.

The brain is a fascinating piece of hardware, especially how it supports language. For example, I would guess OOP is more suited to human thinking because language (and hence metaphor) is supported directly in the brain while mathematics is a more recent invention that we have to "learn."

I guess there is a reason research in visual programming started the whole field of HCI. Good luck with your work!
Two bombs.
I just hate NULL standing in for a boolean notion of existence, I'd rather see a separate boolean member indicating the validity of the other member (string middle_name; boolean has_middle_name;). Or in a strongly typed language an Option/Maybe type. Just assigning things NULL sometimes has the problem of people looking at the object and assuming everything will always be populated.
How about War and Peace performed by mimes?
Good up Steve, happy to see another frostbitten northerner do well!
We have thought about it, but we would need to either make a smaller version of the lamp or have less LEDs (a compromise we weren't willing to make). We pull close to 2A with the 40 LEDs right now. Most USB supplies and ports output around 0.5-1.0A.
Bonedryhumor`s "Star Wars"
I guess you don't agree with Poul-Henning Kamp in his FOSDEM keynote this year: https://www.youtube.com/watch?v=fwcl17Q0bpk (around 15:00)

His claim is that browsers treating websites with self-signed certificates as less secure than non-encrypted websites by displaying big fat warnings is just about the greatest gift we can give to organisations like the NSA. It's not true that there is no material distinction between an active attack and passive eavesdropping. For the NSA to do active MITM attacks on all self-signed https traffic (in a world where all unencrypted http is replaced with self-signed https) would take massively more resources than passively monitoring unencrypted traffic. Plus the odds of them getting caught would be very high (since some people are going to notice that the certificate that shows up on the client is not what the server sent).
It has a 30 day free trial and you can use it for free if you limit to a few hundred datapoints (not ideal but workable.)

It's not perfect for this application though because it doesn't bitwise operations or use execution time as a fitness function.
I should also add, that's close to 2A when on full white. Most of the 'moods' on the lamp do not draw anywhere near this.
I know, just kidding, I know the server did not mean that :(
It is nice too see that websockets scale well.
Non-violent solution: https://gist.github.com/anonymous/af2da1fb4ab84945e129
Soylent sounds like a nice substitute when I'm too lazy to cook/order, but I don't think I'd ever trust it to be the only thing I eat. What about vitamins/etc?
My point was that the period of defection would not last long, because of the high demand; the cheap supply would be gobbled up quick. The hotel prices are the result of organic market forces, not collusion.
OpenSSL is a mess on its own. Other libraries are better organized and better documented, so I doubt that it is the fault of TLS or x509.
Why should we expect the investment in the two to have any relation to each other?
In Amigaland virtual memory is still seen as a quaint but passing fad.

I mean, how are you going to write your own interrupt handlers and schedule your own DMA transfers if you can access neither the CPU's interrupt vector nor the custom chip registers from your process's address space?
Me too. Luckily I was monitoring some lengthly database operations, nothing customer-facing.

Sometimes the streaming reply worked, sometimes it hung, sometimes it crashed. After a few days of pain I rewrote it in Node (which is a shame since the rest of the code is in Ruby). Worked 100% first try, no handholding.

I don't care whose fault it is. ActionController::Live should be turned off until it's more stable.
Surprised no one has mentioned that the Lisp Machine operating system worked this way.

Maybe it doesn't count because there was no protection against intentional reading or writing of memory belonging to other apps or the OS. But the protections against unintentional writing were good enough to make for a remarkably robust system, in a time when nobody cared about security.
I've implemented a handful of simple dynamic languages years ago, and something I was interested in trying, but never did, was taking advantage of the MMU to replace guard clauses.

For example, mapping a few pages for vtables/method dictionaries read only. When something like `def` or `define_method` comes along, catch the segfault (which in this case would actually mean "segmentation fault" instead of "I fucked up") and rewrite all JIT blocks or method caches that depend on that method table. Once everything has settled, generally after startup and the vtables tend to stay more stable, the overhead seems like it'd be negligible.
I personally like dns.he.net. Hurricane Electric is great. The catch? Limit to 50 second level domains.
Upgrading from Rails 4.0 to Rails 4.1
The server will be punished severely, rest assured.
That doesn't make any sense.... even if you don't trust a CA at all, it is impossible for a self-signed cert to be MORE trustworthy, since it provides absolutely ZERO authentication. It could be created by anyone at all, including on the fly by a MITM.
Hang on, all the advice I read is "get it out there, ship it, don't wait for it to be perfect". BUt you're saying it should be polished before release?
(Disclaimer: I know nothing about Ruby, but I know some things about JIT compilers)

Another way to handle this is to assume that Fixnum#+ hasn't changed when compiling a method that is using it (maybe add a check at method entry); but when it does get redefined you "deoptimize" the methods that you compiled while holding that assumption.
You mean something like http://www.voxforge.org/

Seriously there is no massive CC-licensed source of audio data out there. Most of the fancy algorithms for doing speech recognition are on github. What isn't is a massive and diverse dataset. I encourage others to reply if they have seen otherwise.
The advantages mostly lie within the URI principle, and that is not limited to HTML.

App-to-html linking is obvious - I'm much more interested about how html-to-app linking would (or could be made to) work.
What does it mean to you to "own identity"? Do you think there will be one unified identity across services?
@ScottWhigham I'm not being irresponsible. I'm with ghshephard on this one.
Copy here paste there. Copy links and paste them into iPhone
I don't think your correction modifies anything about my original statement. HYP & Friends are interested in admitting "leaders", who are quite often children of wealthy and connected parents.

The colleges don't care if an alum becomes wealthy and successful through their own gumption, or through parental connections. Either way, they reflect glory on the institution. Playing the odds, it makes more sense to bet on the scions of the powerful than the unknown genius.

He's a product, not a leader.

How are those two things exclusive? The next generation of leaders are products of a system that grooms them for power. Elite colleges are a winnowing system and a stamp of legitimacy for America's ruling caste.

IMO medalists have the talent to do much more.

Yes, but only if they choose, and the current incentive structure is all wrong. Unless they have a particular personality type[0] that favors the academic monastery over worldly riches, a rational math genius would go get rich at Goldman Sachs.

[0] https://en.wikipedia.org/wiki/Grigori_Perelman
Neel Mehta donates Heartbleed bounty to Freedom of the Press Foundation
Dry Hair Causes and Main Solutions
O.K. This is probably a stupid question but if it was apparent to many that the code of OpenSSL was horrible why people kept using it and nobody tried to re-factor it? How it is possible that such a popular and critical piece of opensource software survived the years without a complete face-lift and nobody wrote thorogh documentation?
Great demo! Loved the use of WebSocket for control and streaming back the jsmpeg.
Sure the software can, theoretically be audited. But 1) Requires someone actually auditing software. Which judging by the state of OpenSSL flaws, we're doing a shit-tier job at. and 2) Requires people patching the "internet of things" cringe - which we've also seen isn't happening. Furthermore, most of the devices are dependent on closed source drivers for wireless devices.

And you're still just hoping the compromise isn't at the hardware level, because then you're truly up a creek.

Hell, we don't have access to the baseband software in our cellphones or the SIM chip, which can happily take control of the application processor and do what it needs to do, yet we all clamor around the fact that Android is Open and thusly Auditable and that makes it automatically superior in every way.

With enough eyes all bugs are shallow. But nobody's actually looking at the software, so bugs live on, and the big boogie man NSA can still be anywhere and everywhere.

There are Eyes In Your Radio. They're not going anywhere.
Interesting. Clearly I need to explore this more. :)
Still Google/search kind of flattens the namespace a bit. Now you're going to get lots and lots of Java Spring framework hits on any Ruby Spring google searches.
+1 to this. I've only touched very basic usage, but it was easy. And it's HE... big name and comes with reliability.
Woah - have you never heard the phrase "pay peanuts, get monkeys"? Have you not heard of webmonkey.com which uses the very slightly derogatory term in a self-deprecating way? It's a little sinister to bring race into this at all - I don't think anyone else went remotely near that connotation until you brought it up.
A large part of that 13 years was JVM startup time though.
Why on earth would they create a named constant for 1.5F, but not for 0x5f3759df?
Readability matters (Zen of python).

This kind of thing make me appreciate saner languages like python & pascal.

But this make look C too bad it is...
I don't see any mention of shuffles, which I believe are regarded as the most important part of SIMD for high-performance.

Does anyone happen to know more about how/if shuffles are going to be exposed?
Conversely, we attribute far too much immature behaviour to the mythical '14-year-old gamer'. Gamers aren't teenagers anymore, and haven't been for a long time. There's plenty of twentysomething immature gamers, and a few higher as well.
Thank you! The author really deserves the credit here, we love how well it works. https://github.com/phoboslab/jsmpeg
We shared our design with Miguel for feedback ahead of the release. He gave us a boatload of very high quality and informed feedback. Thanks! We haven't been able to act on most of it yet, since it relates more to what to do next than what we released just now.

We're hoping to see this NuGet package supported on top of Mono, too. As we've done previously, we'll share our tests with Xamarin to ensure consistent behavior between implementations.
> When someone says "price gouging", you imagine a vendor raising the price dramatically when they see that someone is in urgent need of something and in no position to negotiate. For instance, if a gas station owner raises the price to $50 a gallon when they see someone limping up with a gas can, and then lowering it again when they leave.

It seems like your example basically fits the real world one to a T. The investors are coming into town with their "empty gas cans" (i.e. need for a place to sleep) and the prices are jacked up accordingly until they leave town.

> This simply does not apply to an investor conference. There is plenty of advanced notice for people to plan accordingly (perhaps even -- gasp -- invest in more hotels if they are raking in so much dough).

Are you daft? Yeah, all the investors need to do is build a hotel in advance of the meeting! Or they could try alternative options, such as sleeping on the street, or in an airport.
The NSA wrote SELinux.
Seriously? More than the "none" which the original post implied.
DNA nanobots deliver drugs in living cockroaches
He really is a genuine wanker: http://www.laweekly.com/2013-10-17/news/snapchat-evan-spiege...
Henry M Levy's relevant 1984 book, Capability-Based Computer Systems, is available free in PDF form on the author's web site: http://homes.cs.washington.edu/~levy/capabook/
That increase in applications per student is totally rational, since students have learned just how random the process is. Admissions officer ate some bad sushi last night and feels ill while he reads your application? Rejected. Admissions officer just got back from a long lunch outside in sunny weather? Accepted. It's not that simple of course, but there is a large random component.

I considered applying to a lot of colleges a "hack" when I did it in high school since most people didn't accept that the process was highly random. But students have caught on since then.
More info on Secrets.yml VS Figaro here http://collectiveidea.com/blog/archives/2013/12/18/the-marri...
Excited to finally try this. Curious if it will live up to the hype/wait. Has anyone gotten an early sample?
My thought is that they have the logs, and they know who was where, and when. So they feed that into an animation/rendering engine and can construct 'scenes' from pretty much any angle or view point in the battle, they can take time to render detailed ship interiors for 'in the battle' views (complete with NPC characters). Do the whole military channel 'great tank battles' type coverage with order of battle before the engagement, key maneuvars, voice over commentary from notable Eve strategists etc. I could easily be done as inexpensively as 'clip shoes' like 'Dangerous Acts of Science' (Science channel) and have potentially a much wider appeal.
[The guru's] contemptuous response is still etched on my brain, "Who the hell do you think you are thinking you can write a C compiler?"

I guess this guy never heard of Leor Zolman and the BD Software C Compiler [0] :-)

I got a lot of use out of that compiler back in the day, but I can tell you, Leor had no idea what he was doing when he started.

[0] http://en.wikipedia.org/wiki/BDS_C
I wish we could dump openssl and recompile all needed software to use polarssl
This was actually the solution I almost went with, but found I could achieve a higher frame rate and lower bandwidth usage with jsmpeg.

We're located in Flint, Michigan and using a DigitalOcean box hosted in NYC. I haven't run any latency tests, but I'd ballpark the number to be in the 250-500ms range. I was blown away that it worked as well as it did.
I don't feel like this is a good name for a food product. Doesn't anybody remember the 70's? "Soylent Green is people!"

https://www.youtube.com/watch?v=9IKVj4l5GU4
JetBrains, yes absolutely. YouTrack is not as popular as Jira but JetBrains' IDEs are very popular. TeamCity is also waaay better than Atlassian Bamboo and sells well in the enterprise.
It's requesting 0x4000 (16384) bytes. Here's what the bytes in the heartbeat packet sent by the PoC mean:

0x18 TLS content type: heartbeat [*]
0x03 0x02 protocol version: TLS 1.1 [RFC 4346, section A.1]
0x01 message type: heartbeat request [RFC 6520, section 3]
0x40 0x00 payload length: 16384 bytes [RFC 6520, section 4]

This should be followed by a payload of that length, but if it isn't (as in the PoC) the vulnerable versions of OpenSSL will then carve it out of the heap to form the response packet - this is what leads to the data leakage.

[*] see https://www.iana.org/assignments/tls-parameters/tls-paramete...
I like this approach but there is a trade-off - you're an SQL injection away from losing your secrets, as opposed to a RCE or file reading bug when they're stored in .env. SQL injection bugs are more likely.
PHK says many things I disagree with.

You can't make browsers simply treat self-signed certificates the same as plain HTTP. You still have to warn the user that their desire for a secure connection (conveyed by their request to retrieve an https URL) cannot be fulfilled, and do so in a way that assures all users will notice before they do something like, say, type in their password.

There is very little self-signed HTTPS traffic out there. The NSA assuredly has the resources to MITM all of it.

Yes, someone at some point would notice if it were all attacked, but the key thing is that, almost all of the time, nobody would, and you yourself have no assurance that your connection has not been MITM'd unless you have done some other out-of-band verification on that specific certificate. That is almost never done, especially by the general public.

You might be willing to gamble your own security, but you should not gamble everyone's security.