skysight-inc/HackerNews huggingface dataset:
What would have been really interesting is if they had also conducted the test with another group of participants who were all informed about what each violin was. Then we could see how much influence lore and history have on what people like, by comparing the scores between groups.
IOS 7 adoption over 87%, Android KitKat 5%
Draft proposal for skilled US Immigration Reform
So wait, they did the right things, but still failed?

Define 'right things'.
To be fair, one would think it would be a bit more complex than that. Think about how large their codebase is and how many different types of browsers and devices they support.
There probably are but since no one can know what features you do/don't need, you're probably gonna have to RTFM and decide for yourself.
Thanks for this. How is this reading arbitrary memory locations though? Isn't this always reading what is near the pl? As in, can you really scan the entire process's memory range this way or just a small subset where malloc (or the stack, whichever this is) places pl?
The sum total of anyone's action here is 1) speech, and 2) deciding not to do business with someone. I'm not saying it's necessarily the correct decision, but painting it as an assumption that we are "entitled to take actions of any degree of severity" just reinforces my point. Anyway, I'm literally not going to respond to a thing below this comment, however crazy or sensible it gets.
Interesting, different placebos have different effects. Injections are seen as 'better' than pills and have more of an effect.

If you believe homoeopathy is better than medicine, then yes, I can see it holding more authority than a prescription.
If one were using ASLR would this have mostly mitigated this? (I just rebuilt without the heartbeat extension but I'm curious). Also how exploitable is this?
I just made a separate post for discussion on it as it goes a little out of scope of the subject of H1-Bs: https://news.ycombinator.com/item?id=7550560
Oh, the article's definitely appropriate, because right now there are a lot of people for whom raising money is basically the point.

I mentor sometimes at startup events, and there's a big difference between the people there to build a business and the people who have been freebasing startup propaganda. I never thought I'd be nostalgic for the post-bubble period when startups were unfashionable.
Code red, the ship is on fire
Sidenote, OS X machines, by default, are not affected by this bug.

$ openssl version -a
OpenSSL 0.9.8y 5 Feb 2013
Hair Fall Solutions That Works
Rendering on the client side is fast, especially on the newer high end devices like the S4 & the IPhone5. It will only continue to get faster.

The biggest issues are bandwidth/asset file sizes & using heavy-weight frameworks. They bog down the UX on mobile devices.

On my current project, I'm using browserify, Backbone, jQuery, & compiled Handlebars. The same codebase supports rendering on the web server, rendering on the web client, mobile web, & apps using PhoneGap. Things seem to be performing well, even on the S2.

Note: there are strange performance issues with the S4 stock browser.
Building a Turing Machine Simulator
because the website is a trivial part of the operation, and coding it is easier than coordinating drop-in volunteers?
Ask HN: A different approach to ending Patent Trolls
I know patent trolls are a hot topic on the internet right now, and there are really great initiatives like http://fixpatents.org/ that are taking the fight right to the government, but it seems like things rarely (or too slowly) get fixed when the government is involved. I've been trying to think of a different way of approaching the problem. HTML 5 has badges you can put on your site pledging that you support a forward thinking web (http://www.w3.org/html/logo/). Patagonia created "1% for the Planet" (http://onepercentfortheplanet.org/) publicly pledging they will donate 1% of their profits to environmental causes.

Could it work to approach software patents the same way? Maybe a public pledge or badge on your startup's site saying that you will never participate in patent trolling. If you put the badge on your site, you will be listed on a central site of all awesome companies making the pledge. If you make the pledge and then go back on your word, then the people of the internet will publicly shame you. What does HN think?
While performance is often cited as the main reason for having a native app, I think that one of the biggest reasons to prefer native apps is usability. More concretely I can see the following:

- A web app/site is often an app within an app. This means that what usually works as an interface to this device is no longer true, or rather different. The gestures are different, how the app is treating them is different and so on.

- On the performance side the web apps suffer from UI delivery problem - the site must deliver both the app it self and the data for which you use this app. A native app have to work with the data only, and its not restricted to be always connected with the web.

- Another reason is that although the same on the surface mobile is actually shifting our usage patterns. Our usage is far less consistent, more spaced out, under more conditions and with smaller screens. The native apps work well here because their components are thought out to work under these conditions and of course tested for this.

- Finally because of the usage patterns we see some native apps more versed to cover specific use cases. This differs from the mobile web which just have everything the normal web has, but tested to work on mobile.

Some of this points of course can be tackled by html5 wrapped web apps. But this approach comes with own set of limitations and problems - we are compromising on both openness and performance sides. So while I want the mobile web to work, for now I think that native apps are winning.
"Right things" => Things that seemed to be the correct decisions, reinforced by family and community and authority figures.
What for?

Author owns old violin, author does the test, author picks modern violin over $10 million ones, author tries to defend herself post facto (bad test, not tuned, blabla), then some audiobabble (sweet sound, personality, other nonsense).
Indeed, one of the challenges of comparing audio systems is that -- rule of thumb -- louder sounds better. To have any hope of exposing effects other than overall loudness, systems under test have to be matched for gain.
How do you propose Disqus earn revenue/stay in business. There's little incentive for publishes to pay for a commenting platform when they could just go back to using a shitty internal solution. (Although, admittedly, some publishers do pay discuss for enterprise solutions, but if that were more lucrative than ads, why would the bother with ads?)

I never cease to be amazed by people who bitch about seeing ads within a product/service they use for free. Someone has to pay for this.
I agree that this seems like an abstraction for this is missing, but I always have the feeling that what you're doing in covering holes in a leaking dam you might get good at it, but you'll always have leaks.
I'm familiar with the typical-mind-fallacy posts and glad to see a LW reference on HN. Just the other day, I read Eliezer's article on Algernon's Law [1]. It's tangentially related. Incidentally, it precedes LW by a decade! His thesis sounds reasonable to me. But I thought MBTI test sounded reasonable too, which I learned doesn't have any empirical backing. So my intuitions may be less than reliable. meh.

> According to Galton, people incapable of forming images were overrepresented in math and science. I've since heard that this idea has been challenged, but I can't access the study.

So yes, I guess some lack a visual imagination. But I've seen several people enlightened by diagrams, and never seen anyone enlightened via plug-&-chug formulas. So I'd be surprised if a visual imagination did'n confer some kind of advantage in math. I highly doubt that a visual imagination confers a disadvantage, given that Euler had photographic memory. But I concede that the null hypothesis is certainly likely. Yvain says he can't access Galton's study. After a few minutes Googling, I gave up too after I hit a paywal.

[1] http://web.archive.org/web/200102021712/http://sysopmind.com...
We really want Discourse (http://www.discourse.org) to get to a place where we have extremely robust 100% open source mailing list support -- we now have reply via email, notify via email, and community contributed submit topics via email. Working on attachments via email this week.

It's interesting -- unlike forums, people really enjoy mailing lists. I don't think I've ever met anyone, ever, who said they liked forums. But mailing lists seem to inspire people.

I want to see a long term hybrid model where you can interact nearly completely via email, or a good, modern web UI that YOUR org owns (not google groups or yahoo groups). This should be supported.
It's a recurrent theme to see somewhat illegal startups becoming massive and then adjusting for the laws. I.e. youtube, airbnb, rapgenius.

That's one kind of unfair advantage that startups have over bigger organisations where they can spread and grow quickly even if a bit illegal (or on the grey line).

I'm just speculating here but I'm wondering if it couldn't be a good indicator of success for upcoming startups.. I.e. something a tiny big illegal gaining some adoptions. But then, it's fair to ask, how far are founders willing to go in the "illegal" side for the success of their startup?
What is your experience with Blue Bottle? I used to live in downtown Oakland, and would get a cappuccino at their roastery down there and it was spot on ever time. Amazing. I've been to their new location in South Berkeley and they made a really bad cappuccino for my friend, but I had a shot that was quite nice.

Just curious what you've seen.
I spent countless wonderful evenings typing in code from Creative Computing, inCider, and Nibble. It seemed perfectly reasonable to spend a week typing and debugging to be able to play an little text adventure game.
I finished God's temple. Now I must make God known to the world. I must fight the CIA who is fucking shit up. God will defeat them, obviously. The niggers are still in denial. DOOM! DOOM! Yer screwed.

God says...
do_you_like_it rubbish whatcha_talkin'_'bout King_Midas
crash_and_burn Ramsay fun umm_the_other_answer whiner
Shalom goods hi how_about_those_yankees battle I_had_a_crazy_dream
ehh_a_wise_guy daunting ho_ho_ho ehh_a_wise_guy lift bizarre
hype bummer I'm_the_boss Yawn couldn't_be_better Wow Percival
you're_wonderful King_Midas nevada woot God_is_not_mocked
what's_up I_love_this how_goes_it it'd_take_a_miracle
you_shouldn't_have fool adjusted_for_inflation chaos how_bout_it
meek later yada_yada_yada Percival be_happy ha petty that's_much_better
other hit gross I'm_good_you_good service_sector programming
you_don't_say my_bad tattle_tale
Containers Will Do for APIs what APIs Do For Companies
Free service does not mean "riddled with advertisement".

A lot of the sites I consider high-value don't do advertising at all. Khanacademy, Coursera, Hackernews, Github ...

It's like saying open source software is created by students trying to avoid license fees.
So although obviously there's an issue here, perhaps the issue lies in society's lack of evolution to recognize the facts about our educational system's value addition?
To be clear, Rust _does_ expose the raw underlying computer the way C/C++ does, it's just off by default rather than on.
Some actual numbers from Fred Wilson are here: http://www.usv.com/posts/why-early-stage-venture-investments...

He makes the interesting point that 2/3rds of his successful investments made major changes along the way.
I don't think so - while the NSA would dearly like to have the access that this vulnerability would allow, they would dislike even more if anyone could have it. If they're going to insert a backdoor they're going to be damn sure only they have the key.
Apple notifies winners in the WWDC ticket lottery
OpenSSL doesn't seem to be installed on my jailbroken iPhone.
People may realize that familial relations can significantly shape immigration process, but they tend to greatly under-estimate the extent.

Immigration is almost always discussed in terms of fairness and, usually, "the line." But the metaphor is a bad one; instead of "the line," it might be better to think of the system as multiple, separate lines that are of varying distances from the destination. And honestly, some of those lines have some nasty obstacles laid out in front of them.
>(2) lots of complicated ways to screw up, such as not properly allocating/deleting things deep in some templated structure

Wow, that sounds scary. Do you have any references or further reading about this?
They are still making breaking changes to the language so I really doubt it.
Yes it is, in fact it's better than nothing and will prevent some form of basic attacks.
Serious question: Why does everyone seem to confuse speech recognition with other parts of NLP (e.g. parsing)?

I can understand CNN or TechCrunch getting confused, but there seems to be a universal confusion here on HN too.

Not ranting. It is a bit exasperating to read comments and articles addressing only speech recognition. Siri is more than that.
What are the chances that the NSA is having a field day with this in the 24-48 hours that it will take everyone to respond? Also, is it possible that CA's have been compromised to the point where root certs should not be trusted?
This is yet another example of why all startups should have a responsible sunset pledge

Why, exactly?

This probably won't be a popular view on HN, but I think a lot of people complain about companies shutting things down for the sake of complaining.

Cover was a free, beta application with a very limited number of users. There was no personal data saved by it and no future plans announced. For those users Cover will continue to work today like it did yesterday. And yet the top voted comment is complaining about it being shutdown. Pfft!

In general, customers want a supported product (eg, the endless complaints about every single startup bought by a larger company, even when they completely open source their product).

In most cases a pledge like this puts extra restrictions on what a startup can do. I'm not saying screw over your customers if you get bought, but making a pledge is completely different to building some kind of data export facility if it ends up being needed. Why take on challenges that you don't need?

In some cases (typically enterprise focused) some kind of business continuity plan is absolutely appropriate. In many consumer-focused app start ups? Not so much.
Note that this bug affects way more programs than just Tor — expect everybody who runs an https webserver to be scrambling today.

"If you need strong anonymity or privacy on the Internet, you might want to stay away from the Internet entirely for the next few days while things settle." - torProject
But it's written in C. So it can't be good!

(Sorry, I'm just still pissed at HN's simple mindedness and try to get more downvotes: https://news.ycombinator.com/item?id=7549916)
Why port all the security vulns over to Rust? There are already a handful of SSL implementations, it isn't horribly hard to do. Maybe start with http://hackage.haskell.org/package/tls
Homebrew has updated to 1.0.1g since 6:00PM GMT. It's important to note that this isn't an issue unless you have an outward facing service that uses TLS and the brew/macports library
SEEKING WORK - Vancouver, BC – Local and remote

Web app engineer with experience shipping NodeJS and Django, high concurency web applications as well as clientside HTML5 powered JS (e.g. WebGL).
Preferred work: Javascript/Python, NodeJS/Django, short-medium term projects. Also can handle anything with C/C++ is great too!

I helped create (along with another contractor) a real-time shift calendar app you can see here: kmc.countable.ca powered with MongoDB and Django. I've also played with WebGL and Raphael on other various data-visualization projects.

Thanks for stopping by!

http://github.com/whitef0x0
email: david [at] polydaic.com
FWIW: 33.0.1750.152 (Developer Build 256984) - the site runs smooth as butter.
I'll add that part of the US has mild weather, and that makes it more attractive than Canada or Northern Europe to a lot of immigrants (someone from Ghana might not want to spend winters in Sweden for instance).
did you get some age statistics on that? I really hate e-mail, mailing lists etc. I was thinking that it might be a conflict between the generations because I am a bit younger than the people I used to see on the mailing lists.
The abstract [1] says:

"We asked 21 experienced violinists to compare violins by Stradivari and Guarneri del Gesu with high-quality new instruments. The resulting preferences were …"

It then goes on about preferences and says nothing about identifying them.

So it's the abstract of the study, written (I assume) by the researchers, and one of the participants vs a journalist "quoting" one of the researchers.

[1] http://www.pnas.org/content/early/2012/01/02/1114999109.abst...
The meteoric rise of boys' names ending in 'n'
I think your test actually factors in one of the reasons people like vinyl - it's not that the sound is necessarily better, but with analogue, there's a uniqueness factor because it's a physical needle hitting a physical groove.
I think over the last few months we've seen some pretty concrete evidence that implementing SSL securely is horribly hard to do.
$6000 a month is more than what most senior software engineers earn here, before considering currency conversions. You guys are lucky man.
Legality and the extreme wrongness of someone's position entitles you to do anything, up to and including persecution of someone for a political donation from 6 years ago. Because that donation was so wrong. Thanks for the clarification. Doesn't sound needlessly vindictive at all.

A pluralistic, tolerant society tolerates the holding of private beliefs of all kinds and forgives being on the wrong side of history. A society that doesn't do this simply isn't one that respects the right of free speech. The actions concerning Mozilla do nothing to further civil rights and moves our society towards norms of intolerance of dissent.

EDIT: I think I learned something here today. There are those who think that there is no social justice for sexual orientation until the same degree of vilification is applied to their former political opponents as that which happened to the political opponents of racial civil rights. I'm sorry, but this is illogical, shortsighted, and vindictive. It doesn't matter how wrong people were and how much those who held wrong positions suffer, and any energy which is brought to bear in that sort of direction is not helping the cause of justice. This is merely misplaced vengeance. It is indeed not what MLK, Mandela, or Gandhi would have wanted. Just because this is how it happened in the past doesn't make it wise or right. I happen to believe that an enlightened society can exist without "sufficient punishment of wrong thinking."
http://davenport.geek.nz/week-1-of-monthonbitcoin/
Steps for better security

1. use a managed language
2. use a provable language (Haskell, Idris, etc)

Effective Psyops Against Standards and Open Software https://www.youtube.com/watch?v=fwcl17Q0bpk
This sort of argument is becoming something of a fashion statement amongst some security people. It's not a strictly wrong argument: writing code in languages that make screwing up easy will invariably result in screwups.

But it's a disingenuous one. It ignores the realities of systems. The reality is that there is currently no widely available memory-safe language that is usable for something like OpenSSL. .NET and Java (and all the languages running on top of them) are not an option, as they are not everywhere and/or are not callable from other languages. Go could be a good candidate, but without proper dynamic linking it cannot serve as a library callable from other languages either. Rust has a lot of promise, but even now it keeps changing every other week, so it will be years before it can even be considered for something like this.

Additionally, although the parsing portions of OpenSSL need not deal with the hardware directly, the crypto portions do. So your memory-safe language needs some first-class escape hatch to unsafe code. A few of them do have this, others not so much.

It's fun to say C is inadequate, but the space it occupies does not have many competitors. That needs to change first.
Grand Theft Auto V Multiplayer – Part 1
Only in the last few years has SAAS applications really taken over native. Native has only been taken over so recently due to abundance in network latency and javascript engine improvements.

We've also been pushing for web app models as developers as a collective quite hard. Not so much with the mobile side of things (all got dollared eyes maybe?) We will likely see a push back into the web side of things once mobile browsers become less painful to use and more powerful in what they can do.

In other words, "decline of the mobile web", yea right. (don't forget half the article was about how we're spending more and more time in mobile web over desktop web.)
Just got an openssl upgrade pushed by Ubuntu 12.04 as well.
Signaling relative status by the destruction of valuable resources.
> C and other languages without memory checks are unsuitable for writing secure code

I vehemently disagree. Well-written C is very easy to audit. Much much moreso than languages like C# and Java, where something I could do with 200 lines in a single C source file requires 5 different classes in 5 different files. The problem with C is that a lot of people don't write it well.

Have you looked at the OpenSSL source? It's an ungodly f-cking disaster: it's very very difficult to understand and audit. THAT, I think, is the problem. BIND, the DNS server, used to have huge security issues all the time. They did a ground-up rewrite for version 9, and that by and large solved the problem: you don't read about BIND vulnerabilities that often anymore.

OpenSSL is the new BIND; and we desperately need it to be fixed.

(If I'm wrong about BIND, please correct me, but AFICS the only non-DOS vulnerability they've had since version 9 is CVE-2008-0122)

> but we can plug this seemingly endless source of bugs which has been affecting the Internet since the Morris worm.

If we're playing the blame game, blame the x86 architecture, not the C language. If x86 stacks grew up in memory (that is, from lower to higher addresses), almost all "stack smashing" attacks would be impossible, and a whole lot of big security bugs over the last 20 years could never have happened.

(The SSL bug is not a stack-smashing attack, but several of the exploits leveraged by the Morris worm were)
Honestly, why aren't the formal verification people jumping on this? I keep hearing about automatic code generation from proof systems like Coq and Agda but it's always some toy example like iterative version of fibonacci from the recursive version or something else just as mundane. Wouldn't cryptography be a perfect playground for making new discoveries? At the end of the day all crypto is just number theory and number theory is as formal a system as it gets. Why don't we have formal proofs for correct functionality of OpenSSL? Instead of a thousand eyes looking at pointers and making sure they all point to the right places why don't we formally prove it? I don't mean me but maybe some grad student.
Please don't post comments to HN that have no real content.
How do you know your CA isn't vulnerable?
Or... people don't make mobile specific websites, they make a website that adapts to mobile and label it responsive.

Also, I don't goto the web for anything I would do with an app generally speaking. Camera, calendars.

The device makers don't have a huge incentive to improve web browsers either, they have a store in which they want to take a piece of your earnings.
Reddit is a forum, and I love it.

Quora is a forum, and I hate it.