skysight-inc/HackerNews huggingface dataset:
"All Turing complete languages allow you to do anything all Turing complete languages allow you to do."

This is false. All Turing Complete languages allow you to compute anything other Turing Complete languages allow you to compute, but that says nothing about encoding, or about interaction with the world. For an obvious encoding example, imagine you have a turning machine that can write only the symbols 0 and 2 to its tape. This is obviously Turing complete - it's isomorphic to a TM that writes 0 and 1, the TM doesn't care how the symbols are labelled. Now, if we ask it to encode 7 it has no trouble doing that in some encoding, but that can't ever be "111" on the tape.
> moving the job of identity verification into OpenID identity providers

Please, don't. This idea is horrible.

With OpenID (and xAuth and Persona and whatever) your identity is provided, not asserted. This is very important distinction. I believe, any sane person wants to be a source of their identity (that's asserted by others), not to lease their very identity from a third party.

If you want an identity - generate a keypair. Publish your public key and let others sign it to assert this keypair is genuinely yours. It's that easy. (Although, sadly, X.509 doesn't support multiple signatures, so one can't do a proper web-of-trust with them.)

If you want automated domain ownership verification and completely automated certificate signing (and whois-pointed email ownership check is not to your taste) - well, how about putting a CSR right in TXT record of the domain? CA-bot would see those and sign them. No need for identity providers except for a domain registrar.
Are there any papers on the topic of including this new data written by actual meteorologists?
I concur, LYAH was, for me, not a terribly useful intro to Haskell.

Running through some chapters of Real World Haskell online, however, is proving to be a bit of an eye opener ;-)

Might just be that I could care less about hand drawn illustrations and the occassional somewhat humerous aside.

YMMV, many seem to love LYAH.
Since we're all sharing our fizzbuzzes, here's mine (from my blog http://seriously.dontusethiscode.com/2013/04/29/bad-intervie...)

Note that this solution is generalised for any divisors and generates an infinite sequence.

from itertools import chain, combinations, count
from operator import mul, add
fizzbuzz = lambda terms: (lambda terms: ({x%d:w for d,w in terms}.get(0,str(x)) for x in count(1)))(tuple((lambda (d,w):(reduce(mul,d),reduce(add,w)))(zip(*x)) for x in chain.from_iterable(combinations(sorted(terms.iteritems()),s) for s in xrange(1,len(terms)+1))))

terms = {3:'fizz', 5:'buzz', 7:'baz'}

from itertools import islice
print list(islice(fizzbuzz(terms),None,25))
I've been using PositiveSSL. I am paying less than $10 a year for a basic cert, revocation is free.

I don't know anyone else who uses it, but there's nothing not to like so far, unless you are the sort who expects to pay nothing at all for your certs.
I have always liked the idea of these bots roaming github, looking for bugs to fix and code that could be improved. But, it almost always ends up annoying somehow. Either the change is a false positive, the bot doesn't understand the project structure, or the bot just spams changes. Software development has too many unwritten rules and social interactions for a bot to just send PRs and comments.

Perhaps another type of communication, other than issues, PRs, and comments, is needed just for bots. I would tolerate my projects being scanned, if I could separate the human and bot communication streams. (And, block bots when they don't work as expected.)
Business owners, beware. Try to find a business model that doesn’t attract patological customers.
I use $5 servers to setup images and then destroy them, but I spin up $10+ servers from those images for everything that runs all the time - just as another data point for you.
Well, by "unpredictable" i mean truly unpredictable. You can randomly get seg-faults with no stack trace nor log, 100% CPU sorted only by dirty tricks that totally out of question in production-like environments, etc..

Most of the problems weren't caused by mono alone nor by the app alone. The really buggy behaviors came out with the interaction of the two.
Posts without urls get penalized. I recommend that you repost this using http://mattdesl.github.io/impressionist/app/ (or a slightly tweaked version of the url), with the same title. (Don't forget the "Show HN"; people watch for those.) This is great HN material, the kind we need more of!
One of the solutions in the comments I found quite pythonic and concise. Somehow people have it in their heads that "Pythonic" means long-winded. And yes, you have to read the code and think for a second to understand it, but that's no crime.

[(not x % 3) * 'Fizz' + (not x % 5) * 'Buzz' or x for x in range(1, 101)]
Yeah, that happens if you force push.
I love this. On just about any team I have worked on, whenever a fresh PR comes in everyone goes through it picking out style guide violations. It's tedious, annoying and sometimes arbitrary if the team doesn't have a solid style guide in place. Hound will let us get right to reviewing what matters: the code itself.

Up next: I would love a Unix utility I could filter my uncommitted diff through and get style guide violations before I even upload to GitHub. Use git for everything, baby.
It's not just their Mac one. The one on Windows for me kills it, it just seems to make the machine really slow (only whilst it is syncing). Seems as if it is a bit of "the nature of the beast" as it's a similar story with other desktop clients. Great apps otherwise!
> "How do we convince that brilliant engineer that has the idea he's really passionate about, that can change the world, to start a startup and not go work as an engineer at a big company?"

I like the thought behind it, but it seems a liiiitle bit ingenuous to say it like that because success usually constitutes being acquired later on by the supposed "big company" and VC's making a lot of money.
Sigh.

I have a serious medical condition. I have spent 13 years getting myself well when doctors said that could not be done. I get a shitshow off of other people when I try to share information about what I did to get well.

I think real health companies include things like GNC and gyms and "green" construction companies. I am aware we will always need medicine (both the field of it and drugs) but the framing of what works is very different in my mind from how you are framing it. It isn't a case of "socially conscious drug testing" versus "blithely torturing animals to get product to market."

I am not trying to discourage you from creating a database to help people make job hunting decisions. I am just saying that this isn't and apples to apples comparison and isn't even necessarily an apples to oranges comparison. What kind of data/metrics you include matters. I am just trying to encourage you to think more broadly about the topic.

Best of luck.
I loved it, but I'm bias as I love all of Mike Judges work. I don't really find most his his work boisterous comedy, more a charming satire that I can watch over and over and still enjoy.

I do find however when I try to retell scenes from his work I often choke up with laughter more in the retelling than the watching. I can't retell a scene from office space ending up gasping for air LOL I think thats the genius of his work, and I definitely got that feeling watching it.

His other strength is always the depth of his characters, their nuances, and subtly... so they get funnier the more you understand them. The characters from King of the Hill are some of the best thought out characters I've seen on television, the mannerism, reactions, interactions, just brilliant.

From what I saw of the characters there definitely was a lot of that to come, so hopefully as it develops it'll become something truly amazing.

I can't wait to see more of this show for that reason, everything looked promising, and everything looked balanced for great satire.
In C, sequencing isn't typechecked. In Haskell, it is. Actions must be compatible to be chained together in (what in C would be) a block.
As a user, I much prefer that my browser and my OS never ever again show a StartSSL-signed cert as valid over even just one compromised cert being displayed with a fancy lock. How StartSSL is going to achieve that, I don’t care, but neither do I care whether or not they go out of business over this.
Millennials Trust User-Generated Content 50% More Than Other Media
I hope this will help :) Not what I know of but if you have any ideas please share so can I expand the page.
Blogging Tips: Staying Inspired
By All Means, Roll Your Own
>$795 / year for a 5-user team. Additional users are $125 / user / year.

I love dropbox for personal use. But hey! ever heard of Google Drive and know their pricing?
Yes, there are quite a few relevant papers. Here's a preliminary study from 2006 regarding weather forecasting using surface pressure measurements on the synoptic scale: http://journals.ametsoc.org/doi/abs/10.1175/BAMS-87-2-175

A number of papers have been published since as that work has continued. So we know that surface pressure data is useful on a large scale; is it useful on a micro- or mesoscale? A few researchers are actively writing and publishing papers on this topic. Cliff Mass at the University of Washington, along with his colleagues and students, are leading the charge.

https://ams.confex.com/ams/94Annual/webprogram/Paper236282.h...
FreeBSD News now part of the iXsystems family
iXsystems is proud to announce their recent partnership with freebsdnews.net
This is particularly of interest to those of us who e.g. have a web application with an embedded HTTP client for e.g. processing web hooks, hitting APIs, downloading image files for avatars, etc. If your application can be coerced into fetching either a) an attacker-chosen URL or b) any HTTP URL, you can be sent to a malicious server which heartbleeds you. (If the attacker can specify the URL it's trivial, if you get any HTTP URL then the attacker can use a privileged vantage point to MITM the HTTP connection then 301 redirect you to a better URL.) Can you imagine any freed memory in your appserver's process which you wouldn't want an attacker to have? Good answer!
I wonder what percentage of StartSSL's customers are actually pathological though?

I mean, are there cases where the pathological customer is a justifiable cost of doing business? Is StartSSL one of those cases?
OpenSSL is a monoculture. Refactoring it or trying to prettify it would be a waste of time. The right response is to create a completely separate open source project that implements SSL/TLS. The biggest problem that comes to mind is that there are only so many people expert enough to do it right and lots of those people are already on OpenSSL, and produced the mess there. Then there's the adoption curve -- while there are probably quite a few people who'd jump on a better library, there is lots of inertia in the big and important projects.
You can also accomplish this without pull requests by writing good messages in your merge commits like you would in a pull request description.
That sounds like an overkill, in this case it's easier for your phone to get your ambient temperature from some wather server around the world.
Of course you can have memory bugs in Haskell, but it's obvious that you're doing special memory stuff.

http://hackage.haskell.org/package/base-4.7.0.0/docs/Foreign...
> most white cis straight men

Stopped reading there.

This is straight out hate speech.

Shit like this has no place on this site.

There has been a concerted effort by SJWs over the past few months to spam more and more of their hate speech on this site, and stricter measures should be taken against them.
He forgot one on the "i += 1" (which would be i++ in a for loop but Python doesn't have that operator).

But that whole line is weird, because I think the C example should use a "for" loop, not increment the main counter at the top of a while loop, even if it has to use "for i in range(1, 101)" like in pythonic python. A C programmer like me (who loves python too) would immediately think "for (i = 1; i <= 100; i++)" for that (although counting from 1 is strange, it's what the problem asks for).
Raspberry Pi's Eben Upton: How We're Turning Everyone Into DIY Hackers
Well, the internet is only ~20 years old. I'm not strong enough in statistics to actually model this, but if something "this bad" happened once within 20 years, it might be reasonable to expect it would happen again within another 20. It's possible it is a every-hundred-years event, but unlikely. Perhaps even more often in the future, as software complexity continues to grow?
Crossing the Chasm and Four Tech IPOs from Last Week
I'm curious if you found some reference sites that had been successful running C# web apps on Mono, and if so what are they?
Red Hat Enterprise Linux Server release 5.6 is still supported and ships with OpenSSL 0.9.8e which is not vulnerable. I am sure there are other examples as well. If I had a StartSSL certificate and the browsers started to remove support of them or warn that my site has a StartSSL certificate signed before a certain date and cant be trusted I would be really pissed.

I have always felt there was conflict between system administrators wanting proven and stable versus developers wanting bleeding edge. I have given up the fight when it comes to web development and use Ubuntu 12.04LTS which still is not bleeding edge enough for most of my dev's. For infrastructure components outside of web development though I dont think its a safe assumption that people are on a vulnerable version.

This is a prime example of why I would never give anything away free. Unrelated to SSL certificates; I rather throw out my old equipment than give it away since the people I give it too will never be happy and don't understand its free for a reason and demand support. The fact that you cant afford something better does not give you rights to it.
I know there are subtle differences in the .net memory model compared to mono. I've fallen victim to this sort of thing before and depending on what you are doing and how aware/disciplined a team is, this could very much be a pain point.
It's probably safe to say people have been wondering that for decades.
You're really comparing mocking one of the most privileged groups you could possibly mock... with blackface. Seriously?

You are exactly the kind of person that motivated Mike Judge to create this show.
But isn't that the point of a web browser? You're not viewing the whole of the internet at once, you're just viewing this one document. To go to other documents (down, up, sideways, within) you use hyperlinks?
Thanks :) Glad you enjoyed!
It is worse than plain HTTP, actually. Heartblead allows an attacker anywhere on the internet to read out memory from your server. This is worse than plain HTTP in two ways:

- With plain HTTP, the attacker would have to be in a MITM position to intercept traffic. With Heartblead, he can read traffic he wouldn't normally have access to from the server's memory.

- There may be secrets in memory that would never even be sent over the network that are now accessible. For example, if running a web app in the same process doing SSL termination, private keys such as Django's SECRET_KEY may be available. Under certain situations, knowledge of the SECRET_KEY can effect remote code execution.

In short, Heartbleed gives the entire world the ability to read memory from your server. This is much worse than an HTTP MITM.
was hoping to hear something more concrete and what you had to do to resolve it (also what finally broke the camel's back to decide to walk away). I realize it could involve a bit of verbage but given the interest in .net openness these days, some real world scrutiny would be beneficial to us interested observers.
git
git/
nounBRIT.informal
1.
an unpleasant or contemptible person.

haha...i had no idea.
Well, that's one of the most powerful arguments in favor of CAs I've ever heard.
Well, this is not like the first time the TLS stack has a disastrous vulnerability. I think that giving out free certificates and charging for revocations is bad business since it sets bad incentives. Better then to charge upfront for issuing the certificates.
I think this misses the point. The unchecked copy won't just copy freed memory, but will rather snapshot up to 64k of the heap, by issuing multiple malicious heartbeat packets and varying their size an attacker can probably build a fairly comprehensive view of the heap.

it might be interesting to consider storing keys out of the heap
Professional Software Development – Can We Mandate What We Can’t Define?
This sounds suspiciously similar to popular arguments against the mostly-button-free iPhone interface to me.
If you can code, you're not enjoying school, and you're always coding instead of studying anyway, just drop out for a few years and go join a startup (they don't care about degrees). You can always go back to school if it's absolutely necessary.

Disclaimer: it's what I did, so I'm biased.
Until there is final proof and production of sufficient evidence, this post is as valid as the claims that information was extracted.

Whilst I completely agree that if taken as a reason not to update this is unhelpful, the OP isn't enumerating reasons to not update, he's providing early assessment and commentary.

As an industry we've once again not done ourselves any favours with the way this has been handled in the media - it started out as the apocalypse of SSL and all we hold dear, and whilst the update exercise was valid, it appears that the percentage of affected systems was actually quite low and the extent of the apocalypse might well have been overstated.

That's not to say there isn't a problem here, by any means - I've spent all day scanning servers and quietly weeping as I watched usernames and passwords dance around my screen - but getting to the analysis of what actually happened should have started before the headlines ran away with themselves.
It's in international waters, the Chinese have no authority here and in any event Australia is coordinating the search. Ocean Shield is an Australian Defence Force ship (although not grey like your typical warship).

http://www.theguardian.com/world/2014/apr/07/mh370-black-box...

The US has a specialist sub-hunter in the area, and they've made extensive use of P3 and P8 aircraft. I doubt they're terribly sensitive about their ability to find a deliberately pinging object 6000m below the surface.

"There are 11 military aircraft, four civilian aircraft and 14 ships taking part in the search on Wednesday."

http://www.theguardian.com/world/2014/apr/09/mh370-search-ar...
His tech skills and his contribution are all that matters when it comes to leading a tech company. You're the one that's missing the point here.
Or better yet, don't even bother asking for forgiveness or permission:

from collections import defaultdict
FIZZ=3
BUZZ=5
cache = defaultdict(str)

for i in xrange(FIZZ-1, FIZZ*BUZZ, FIZZ):
cache[i] = 'Fizz'

for i in xrange(BUZZ-1, FIZZ*BUZZ, BUZZ):
cache[i] += 'Buzz'

for i in xrange(100):
print cache.get(i%(FIZZ*BUZZ), i+1)

But I'm rather partial to the generator versions you and others posted.
Someone who wanted to be sure that bug stuck in people's minds enough that they wouldn't just ignore it? Seems at least feasible.
You can trust the certificates they produce. It's only users who were running exploitable OpenSSL who's certs are at risk through no fault of StartSSL. There will be many perfectly safe certificates from other customers affected if the root trust is revoked.
China's Great Firewall most certainly had the capabilities of capturing plenty of private keys if they knew about this exploit for long enough.

https://news.ycombinator.com/item?id=7561901 Maybe CAs need to revoke their master keys?
RAAS.co needs 100 Rejections
This exists and is what Hound is built on. Rubocop runs lint checks against your Ruby code: https://github.com/bbatsov/rubocop/ . The Emacs integration is great; it highlights failures in place. Hound looks interesting, but having Emacs/Vim integration gives you a tighter feedback loop, so you don't have to wait until Pull Request time to discover these issues.
I think the "define a strict, branchless DSL" approach is the right one, if you're going with Haskell. Then use the type system to ensure that only that stuff can touch key data. No problems with laziness or timing attacks, if the core of that is implemented correctly.
FoundationDB – a NoSQL Database with ACID Transactions
Only sort of.

The main technical point of Theo de Raadt's "exploit mitigation countermeasures" post is that even when the infrastructure it's running on is trying to add safety checks, OpenSSL will often neuter them. The specific example was the exploit mitigations in OpenBSD's malloc, which are neutered for OpenSSL because (for dubious stated reasons) it insists on wrapping the system malloc with its own caching variant. The same would apply, of course, to more straightforward measures like a malloc() which just cleared out the returned memory before turning it over to the app.

And this isn't the only thing about the OpenSSL codebase which seems likely to frustrate attempts at analysis. (Heck, the whole "forest of #ifdefs" thing has got to be at least a bit of a stumbling block.)

Theo's email here: http://article.gmane.org/gmane.os.openbsd.misc/211963

HN discussion here: https://news.ycombinator.com/item?id=7558199
> So what about the '*' in C

I don't like it... I don't what I'd do if starting from scratch, and there might not be better, but it definitely causes readability pain.

> the '.' in so many object oriented language

I have less of a problem with this, because there's some non-programming analog to be found (Section 1.1, Article 3.2, etc.). That said, I think, at some point, it's harmful to OOP in that it makes it hard to sort out properties and messages, and the roles of one or the other.

I agree 100% on readability - the problem for me comes when words get mapped onto abbreviations and symbols that are almost entirely constructed and/or alien to most readers.
I miss Everpix :'(
Sorry to hear that. I was running a mono-based server app for myself for some time. Never ran into any issues but my own. Ran Mono 2.10 on Ubuntu Server.
The issue here is not about boycotting StartSSL because of their 'vulture-like' business model, it is about whether StartSSL can be trusted by browsers to actually secure connections. It can be argued that StartSSL is not actually providing an acceptable level of security, since the ability to revoke and regenerate a certificate is part of the service that a CA should provide. If StartSSL isn't performing security audits, gives out free certificates like candy, but charges for maintaining security, none of the free certificates are actually known to have any level of security.

There are many websites using StartSSL certificates that could also be using a compromised private key. Should there really be a lock icon in your browser if your connection is not actually secure?
Exactly what I thought, especially with the tagline: A home for your life’s memories
If you do that, it is better to create an arbitrary caching construction of subtrees and then reap the benefit by tighter packing of data in general. I agree a keyset cache could be really nice to have going forward. It would resemble what happens in-heap.

But the rule of the Ericsson OTP team is to get it correct before making it fast.
IFTTT encourages to change password not only on IFTTT, but everywhere
So, to all intents and purposes versions appear to act as backups, but you read a Web site a few years ago that said they aren't so that's what you tell people?
Use one of the testers to check if the website is currently vulnerable.
Programming language accents.