skysight-inc/HackerNews huggingface dataset:
You'd be surprised at how quickly common phrases are compromised. According to [1], a 6 word phrase, "it was the best of times", albeit unmodified, was broken in 4 seconds. A less common phrase, "You stay classy San Diego", was never compromised. So there may be some security in a combination of common phrases and modifier patterns, but I would say it's not enough for highly sensitive accounts.

1. http://www.reddit.com/r/Bitcoin/comments/1ndsxi/a_test_of_br...
> industry trends

Why? The VC firms never invest in an "industry", i.e., there are no such 'index funds'.

Instead, VC firms invest in individual companies, and there
what is just crucial is what the company does. If
the company looks good, then mostly to heck with the
darned industry.

> Or they're simply handling recruitment for a stealth portfolio startup.

In this case, poor startup: A16Z is doing a "piss poor"
job 'helping' the startup!
> I now write stock market simulations and come up with trading strategies for a living...

So playing all those chaotic evil characters really had an affect on you eh? :)
If anything I'm less technical than most HN users. I certainly was back when the ipod was new-ish. I was probably more technical than the average user at the time, though.

I gave concrete examples of the usability of the ipod. I would like it if people argued against those points, rather than some smartass, sarcastic response like the grandparent.
From the migrating guide: "This change was made to allow for these [connect] middleware to receive fixes, updates, and releases without impacting express release cycles and vice versa."
It starts with 2000$ then 1000$ increment per year up to 5000$

This deal is for warehouse employees only and most of the people(90%+) working in warehouse are contractors.

They handpick employee(s) and once a year and offer him/her this deal.

BS!
I'm not sure that I've really read anything about the Iraqi Navy's grand defense slowing us down.

And I can't really see us going to war with China any more than we went to war with the USSR.
Is this really an accurate challenge? I have wondered if the true exposure risk from Heartbleed may be over-stated* due to memory separation between processes, etc. This however is probably a clean server with a fairly static install. There isn't a risk of things like session leakage which I think is the true risk of Heartbleed. Nor would there be the memory fragmentation that would occur in a production system. While intriguing I'm not sure how much it proves?

(* this is still good though as any risk is unacceptable and shouting Fire makes everyone move... and they need to on this issue)
> Would you rather have your software written by a foolish programmer who is pleasantly tactful or a competent and conservative one who is tactless?

This is a false dichotomy. Interpersonal skills are among the skills necessary to work on a project that involves more than one person. That covers most of the interesting ones. If there's a successful project with someone who lacks those skills, it's because other people are covering for them -- just like a successful project with a foolish programmer. Sometimes that person makes up for it with other things they bring to the table, and that's fine, but don't pretend a weakness is a virtue.
Well, you also have to remember that the marginal costs of issuing a cert are next to nothing. Once you've spent your money getting everything built out and certified, issuing a single certificate is almost pure profit! That's especially true for run-of-the-mill SSL certificates. Obviously, if you're an enterprise and you want a full, hosted PKI solution there are additional costs and work involved. But, for the commercial certs you buy one at a time from Verisign, et al, the marginal cost is very low.
Yes the lack of syncing is notably missing. That's kind of the tradeoff you get for not using a central service or listing the sites themselves in plaintext (see my note about pass below). I handle it by having a separate private repo for KeepassX and syncing the repo whenever it's updated. It's an opaque blob so there's no real history but it makes it easy to keep my desktop and laptop in sync. I don't modify it too often (seriously how often do you create new accounts?) so it doesn't feel like much of a pain but maybe I'm just set it in my ways.

Pass looks interesting though the convenient way of using it (plaintext name for each site) leaks information. If you're willing to give that up then it sounds like a good idea.
There's no memory separation between a web server that incorporates OpenSSL and... itself.
A different CloudFlare post on HN https://news.ycombinator.com/item?id=7572666 claimed that they had a fix for the HeartBleed bug 12 days ago.

At CloudFlare, we received early warning of the Heartbleed vulnerability and patched our systems 12 days ago.

I commented on that post that the date of discovery was 7 days ago http://www.vocativ.com/tech/hacking/behind-scenes-crazy-72-h...

For whatever reason that HN post was deleted and resubmitted so it now has no comments on it. https://news.ycombinator.com/item?id=7572796

Was the bug discovered 12 days ago or 7?
Also check out the PolarSSL Verification Kit[1], a FRAMA-C verified version of PolarSSL.

[1] http://trust-in-soft.com/no-more-heartbleed/
But what exactly does "for sale on exchanges" mean? Presumably a great many coins that didn't trade hands yesterday are still for sale at some price.
Which is normally not a problem if you're creating a commercial product. You can also get a license for FOSS projects if the GPL isn't suitable.
My father always just supported what my mother was doing. And my mother tends to move on from fad to fad pretty quickly. I'd say outside of a few really hysterical outbursts over the years, I never really felt unsafe. The best modern analogy I can put is like being with somebody who watches Fox News all day and listens to Rush Limbaugh or Glenn Beck in the car on the way to/from work and gets all spun up over whatever the issue of the day is and every once in a while throws a hissy fit about the end of America or whatever.

Same basic mechanism and response, just different subject material.
RIGHT in the feels man.

D&D (and the subsequent Arduin rules) were a HUGE part of my teenage years in the 80s. I had to sell all of my collection to buy tires for my car when I was about 19. Come to think of it, it was more or less my coming of age moment.

I've since purchased almost every book I had as a young kid on eBay, but it's incredibly hard to find anyone who still plays with these rules. Kind of a bummer actually.
If the scientific community were ever as pervasively and objectively wrong on an issue as the Christian community was on the whole Satanic Panic thing, there would be a fundamental loss of credibility. And yet...
- the buyer is very unlikely to be able to track you

the buyer will probably be easily able to track you, if they are paying 100k for hacks on the black market, they would have the resources to find you easily
Dear HN,

Is it really necessary to start another language war thread?

Sincerely, a happy C developer.
"Let me know how I can help" – a proposal to HN
In my shoes. . .
It might be more accurate if this server ran some services, though, like a real server would.
Yes, I think so.

I find that fascinating, because people usually assume that (a) natural language must be context-sensitive, because of ambiguities and all those misunderstandings in real world, where they forget that those aren't syntactic, but semantic or pragmatic issues, and (b) natural language must be at least context-sensitive, probably more, because look at how restricting context-freeness is (e.g. when it comes to programming languages).
Purely on a legal level, getting your most disgruntled employees to identify themselves and waive all claims in exchange for $2,000-5,000 is probably a pretty good deal.
It's a good news. It's one of the main reasons not to even consider moving to USA. Now, let's just fix ridiculously high taxes compared to Europe, sane healthcare system, work conditions and education system, and you might be up to something.
This is a very difficult question and, thus, illustrates
the transcendent brilliance and astoundingly
"deep domain knowledge" of A16Z. An answer is
available only on the bleeding edge of the
most brilliant insights of research in
machine learning. Ordinary people can't expect
to understand such depth! All bow down to
the incandescent brilliance of A16Z -- after all,
one of their founders used C++ to write
a GUI application to read a text markup
language and display the formatted results!
Maybe this was the first time, I mean after
Word, TeX, and some others?
Couldn't they still achieve that by depending on connect, but not depending on those specific connect middlewares?
I very briefly worked on ChucK while at Princeton years ago, although I never finished my contribution to be an official committer. Having spent a decent amount of time with it, I think the biggest problem with ChucK is lack of flexibility within the strongly-timed model. The ChucK operator, `=>` is used to connect together unit generators, but as I recall, you can't use it to connect arbitrary ports of those unit generators together. Each has only one designated ChucK input and/or output. This makes it difficult to truly experiment with modulation. You pretty quickly reach a point where you end up writing the same old procedural code you'd write in C or Java, explicitly manipulating samples instead of streams.

There are many other systems that are similar, including SuperCollider, Max/MSP, PureData, CSound and JSyn/JMSL.

I think the intuition behind ChucK is similar to the functional reactive programming of Elm [1]. But it's doesn't seem as though it's thought completely through. It would be cool to see a true FRP implementation for sound.
Not aimed at you directly, you didn't write the headline.

The concept is a common trope in financial news reporting, particularly on tv.
Two articles on why nuclear will never* scale up:

http://www.carbontax.org/blogarchives/2013/11/21/why-officia...

http://www.forbes.com/sites/energysource/2014/02/20/why-the-...

* (again. It did reach real scale in post-WWII France among other places)
Well, I'm a java developer from Russia and I want to emigrate. But don't know how.
A lot of people here want to leave Russia. But it's not as easy as going from one state to another (USA) or going from one EU country to another.
Free Screen Capture Software for Windows 8
I hope it is true this time.

I sent a question a few days ago:
Ask HN: How many H1B holders here taking the H4 "punishment"?
https://news.ycombinator.com/item?id=7547839

The current H4 only offers a disruption to the family. Nothing else.
That's why they're common fallacies. Not everyone has them, and not all the time, but they're common. There's also a fallacy for thinking you're not susceptible to them, and one for being too hard on yourself.
The bug was discovered by whitehat researchers approximately 12 days ago. It was publicly announced 5 days ago. We got early word of it from the researchers who initially discovered it, allowing us to patch our systems and ensure all sites behind CloudFlare were not vulnerable. However, we have no way of knowing how long blackhats may have had it. It had been present in the OpenSSL software for the last 2+ years. Therefore we're trying to get an informed sense of the security risks. Hence our work attempting to use the vulnerability to recover SSL private keys and, as announced today, the CloudFlare Challenge.
And in practice anything they want. Example: navalny.livejournal.com is not available in Russia for some time. Not chosen articles, whole blog.
RSA was patent encumbered at the time the clause was made to the OpenSSH license. This very likely qualified RSA as "restrictively licensed". RSA was released from its patent in 2000 (just weeks before it expired).

DSA I believe is still patent encumbered.
I give to you that it's better than CORBA

What I don't agree is that it allows a "load this" where this can be a local file, an url in some cases, anything basically
Isn't this just a cheaper version of a voluntary separation scheme? Makes brilliant sense actually.
I don't believe that the presence of the vulnerability is the reason people are looking to migrate. I believe that the discovery of this vulnerability shed light on the code quality of OpenSSL, and that is what is turning people away. Some people have only recently learned of the quality issues, and have lost trust in the project. Others have known about them, but have been begrudgingly dealing with them, and this was the straw that broke the camels back. There's always someone looking to migrate to a different implementation, and all they need is a good reason to justify the effort.
This is what I see: http://imgur.com/aI79G4g

Chrome, Ubuntu 13.10
He just didn't say so in that interview, however :

From: 9fans@cse.psu.edu (rob pike)

Date: Mon, 1 Jan 2001 09:37:12 -0500

Subject: [9fans] Re: The problem with SSH2

Message-ID: <20010101143731.DB61F199E7@mail.cse.psu.edu>

My disagreement with SSH is more specific. It is a securitymonger's
plaything, so has been stuffed with every authentication and encryption
technology known, yet those that are configured when it is installed is
a random variable. Therefore both sides must negotiate like crazy to figure
how to talk, and one often finds that there is no shared language. This is
idiocy. The complexity is silly, but much worse is that there isn't at least
one guaranteed protocol for authentication and encryption that both
ends always have and can use as a fallback. I would argue that that
would always be sufficient, but I know I'm in the minority there. I do
argue that it's demonstrably necessary.

Algorithms everywhere, and not a byte to send.

By making the thing too complicated, they defeat
the very purpose of security. Difficult administration results in
incorrect or inadequate installation. There are cases when I can't
use ssh, a direct consequence.

-rob

Russ Cox chimes in

we're stuck with ssh, but let's not delude
ourselves into thinking it's a good protocol.

(i'm talking about ssh1; ssh2 looks worse.)

russ
Check out https://www.tinfoilsecurity.com
I used it with a small embedded system a couple of years ago and was generally very pleased with it, at least from an ease of use perspective. For the niche I was filling it was a great fit.
I don't know how well it adheres to the standard though, or whether it has known vulnerabilities.
The node.js community seems very unixy, small modules pieced together is the name of the game.
The article made it sounds like a universal offer, maybe I could see per-business unit, but not per-employee. That would require you to already know who the dissatisfied workers are. The stated point was to discover early who is not satisfied in their job.

Do you have a source on that?
This is a disruptive Internet version.
> ...the PS1 turned most young people into gamers and gained mass approval.

Mass approval is a means of consensual intellectual deference. Mass media is perfectly made to broadcast these messages.

The story's always the same: $NEW_MEDIA is harmful, and the domain of ill-adjusted individuals. Until, of course, a vague future when it isn't, even though nothing has changed. No mention is made of the errors in perception made in the past: "we've always been accepting of gaming."

Pop culture can only exist in the present. It cannot bring itself to look back in time, for in doing so it'd have to confront it's mistakes and ephemeralness.
perfect attempt to steal 0day spl0its :P
Researchers find critical speed that makes birds and drones crash (2012)
The proposal does not give a blanket approval for spouses of H1-B workers to work. It only allows spouses, for those H1-B holders who have maxed out the original 6 years on their visa and are now awaiting their turn in line for Green Cards (which for India and China is ridiculously long).

But it still is progress.

I'd hope they remove country based discrimination in EB visas. And better yet pass immigration reform sooner rather than later.

Edit:
Here is the link to the original proposal: http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=20121....
>let's just fix ridiculously high taxes compared to Europe,

Eh? Europe has higher taxes.

http://static2.businessinsider.com/image/50eef524ecad0476690...
Can we get the US federal government to institute this policy? With the caveat that once you quit you are prohibited from collecting a federal paycheck elsewhere.
And this is relevant to the story because...?
Using UDP over IPv4 isn't the max payload size for a packet 65,507 bytes? That would mean that the max length that can be specified is already going to be a potential buffer overflow. What happens if you use specify a zero length? Seems that if the protocol were being defined loosely that should allow for "any length of field that fits within the transport packet" and so allow for larger datagram packets (a la Jumbogram).

Is there a trend to leave definitions of these protocols as loose as possible (eg not specifying the response field in the heartbeat as a double/long or whatever) so as to allow hacking it to serve some other use later?

Guess I'm going to have to look at the DTLS protocol definitions ...
Very cool. Interestingly enough, a lot of Express features are starting to align with Bogart (https://github.com/nrstott/bogart) features, and vice versa unintentionally.
i've read that while the pirates were fishermen in the beginning (who really didn't have much choice), when people realised how profitable it was the trade was taken over by soldiers/mercenaries. the soldier-pirates are a lot worse than the fisherman-pirates and don't give back to the community quite as much.
This level is hard. It took me a while until I found the coords for the transporters I was looking for but in the end I done it :).
tip: find the transporter from the spawn point and the one where the exits is and link them together
Bike Lanes Don’t Cause Traffic Jams If You’re Smart About Where You Build Them
Oh, gotcha, agreed!
Yes. also I suspect some posts are just made less visible than others.

A month or two back I posted a mention of that Six California States initiative that’s going on. I couldn’t find it again.

Facebook is more about wanting you to read what they think is "more popular" for you than being up-to-date with your friends. And funny, the popular stuff is a lot of advertising and game notifications.
Cloudfare isn't making the same claim - they're just saying it doesn't seem to happen on their (modified) Nginx setup.
The Refresh Test
I have never send a tweet and just use it as a news feed. Is there anything wrong with that?
If what CloudFlare is saying is true (and I think it is), that the only possibility of Nginx/Apache leaking the private key is on start up due to how low of a memory address the private key is given, is there anything in Nginx/Apache to fire a bunch of dummy requests at itself before accepting public connections? This should effectively bury the memory address that the private key is stored in. Would this be useful if it doesn't exist or would it only be useful in hindsight?
So useful, thanks alot.
I'm sure this bug was discovered at least 1 month ago. I would not trust my keys are safe even if using cloudflare.
That's horrible. So you have miserable people doing unmotivated work because they think they are stuck here because they passes up $5 to be here.

Or because taking the money makes the feel guilty, but quitting and not taking it makes them feel stupid, so they just plod along feeling angry.
I am really glad about how they responded. Whenever Tinfoil has found vulnerabilities in companies like United Airlines[0], for example, those companies mostly respond with anger rather than graciousness.

[0] https://www.tinfoilsecurity.com/blog/132969897
something tells me a similar snafu made by a CS student would get "fairly rude" comments in reply by any competent instructor or advisor.
Huh? It happens all the time. Look at plate tectonics. Why would there be a loss of credibility? We don't remember Marie Curie as the idiot who poisoned herself.
Apple declines to join Microsoft in funding patent troll Intellectual Ventures
The latest commit message on (the now completely seperate) body-parser module is "asdf". Makes me nervous.
From the related blog post: http://blog.cloudflare.com/answering-the-critical-question-c...

"While we believe it is unlikely that private key data was exposed, we are proceeding with an abundance of caution. We’ve begun the process of reissuing and revoking the keys CloudFlare manages on behalf of our customers. In order to ensure that we don’t overburden the certificate authority resources, we are staging this process. We expect that it will be complete by early next week."
By the way, is it any easier to get a handle that's inactive for like 7 years?
Your theory might explain why the offer is only made once a year. Most likely, your bad day isn't going to line up with the availability of the offer. If it was always on offer, you might be more inclined to jump ship impulsively.
Why Facebook Fails as a Business Communication Tool
Why? I've had that in interviews before when asking people to code. I find it strange (not just because we pre-warn about the agenda) that someone applying to program won't...program? I reasoning I've had has been mainly : "it's too trivial" "I've written gems" "I'm famous"
They actually do restore the site.

Russian authorities have blackholed my site a couple times because some trolls posted illegal material there, and then turned around and reported that site to the authorities. Once the files were brought to my attention and removed, the blackhole was also removed.

As an aside, I hope authorities (and hosts) realise this is a trivial and common tactic to take down websites. It's one of the cheapest and least technical attacks available. Only the really large sites (the 0.1%) are immune to it due to their stature. I'm tempted to say that attackers employing this method are more skilled, because they understand risk-tree analysis better than the clowns with huge fancy botnets.
How to safely migrate data from your old smartphone to your new one
I've been looking into what options exist and what their pros and cons are for switching LuaSec from OpenSSL to something else (mostly in the context of Prosody's TLS support). These are my pros and cons so far, but it's a pretty specific application, so not all points may be important for others.

Pros:

* PolarSSL seems to be very clear code, well modularized and a much more sane API than OpenSSL.

* Supports setting cipher orders by TLS version.

* Cipher support is good (all the new ECC and SHA2 stuff is included), but it doesn't support SSLv2 or EXP ciphers (I'm counting this as a "pro", though).

Cons:

* Not quite as much support for working with X509 certificates. It parses the extension fields it knows about, but if you want to know more than those, you'll have to dig into ASN.1 yourself.

* Related to the previous point: I couldn't find support in converting different ASN.1 string formats. Probably will have to depend on another library to do that.

* I found a buffer overflow bug within a few hours of working with it [1], which is really not a good sign for a TLS library. However, it did get acknowledged within 24 hours (I've got an OpenSSL patch which has been sitting on their bugtracker without any reply for 6 months).

* Setting a different curve for ECC requires a compile time flag to be set, which is disabled by default.

* Using the server's cipher order or the client's is also a compile time flag, can not be set at run time.

[1] = https://github.com/polarssl/polarssl/issues/83
It's the only mobile browser with any kind of extension support, I believe.

I also like the tab-switching view better than chrome's - however, it's hard to access, which is a shame.
It's been present for 2 years.
Uber’s Algorithmic Monopoly