skysight-inc/HackerNews huggingface dataset:
I think it's largely a case of cargo-culting a Rails core decision made somewhat arbitrarily before Rails was even released (ie. config/database.yml).

Theoretically I suppose YAML is supposed to be a human-editable data format, but after trying to get translators to translate app strings in YAML format I decided that YAML is worthless as anything except an interchange format, and even there, primarily for Ruby because of its rich semantics.
What Can CSS Filters Do for You?
CSS filters have been around for a while. They originated thanks to SVGs – Scalable Vector Graphics – in order to apply different image effects to vectors.
So Google+ ?
You can be liable for triple damages if the court decides you knew about the patent and infringed anyway. Normal damages if you did not. I believe independent invention is meant to be so rare as to be suspicious (despite many documented cases where this happened).

The (supposed) purpose is to give an incentive to inventors to freely broadcasting their inventions, by giving them a monopoly on it so they can recoup their investment. Without that incentive, inventors would keep their inventions trade secrets.
Don't Hijack Browser Keyboard Shortcuts
Tilden's Laws of Robotics
>I don't decide which book to read based on what program was used to edit the book.

Yes you do. You read books published by major publishers that adhere to a certain quality or standard. You don't read books that were hand-written on a banana leaf.

>I don't watch a movie based on what software was used to edit it.

Ever seen Battlefield Earth? Didn't think so.

>Why would I judge a picture based on what camera was used?

Usually one is oblivious to the camera used for a picture. However, the camera used does indeed correlate with the quality of the image. The better the camera, the higher quality the picture. This gives information about the site owner's intent for content.
looks great! is the image processing done in the server-side?
No, that's essential, that line is the message.

A secure library should be defensive in coding style and implementation, not sloppy. It should have defaults that err on the safe side, not the fast side, if you have to choose.
That's just sad. I might buy the argument for protocols in general, but for a super important security protocol like SSL, that's just ridiculous.
Where's the source
Sorry, XP isn't dead yet.
Well it's not as easy as you think : it's business specific software.

I work in public transportation : one company provides us with a way to bill customers, from the time they use their card in a bus (you would have to build the card reader too) to sending a monthly bill.

The other company provides us with a way to track our buses (specific hardware too), and there's even a supposed way to optimize their flow.

But if someone wants to tackle the challenge they'll need a "bit" more than an afternoon ;-)
Or maybe it's just a bug. There's really no need for tinfoil hat theories unless you have any evidence for a possible conspiracy.

That being said I agree that OpenSSL could do with a good code cleaning, but that's a massive undertaking, especially for such a popular library. You have to be backwards compatible.

Maybe a big name in software could go and write a modern crypto library without all the cruft of OpenSSL but for now we have to deal with it.
The name fits: You've got to have a deep belief if you trust a 3rd Party binary.
Human Barbie is a “racist space alien”
Snow depth sensors bounce radio signals off meteors
Why conformal? That seems a little too rigid.
The heartbleed bug looks exactly like an NSA backdoor:

* the protocol extension rfc and implementation are from the same person (who is now working for the largest German IT service contractor; formerly state owned T-Systems).

* the extension provides means for one party to send arbitrary data which needs to be returned - a keepalive mechanism would have worked with an empty packet

* there is no input validation on network originated data, in a crypto library, in 2011

This has huge implications on all of the Internet, while the individual parts being reasonably deniable.
Love this guy :D

http://privatekeycheck.com/no/
Some Chinese play on the world server but it's actually more or less illegal (wrt Chinese law) for them to do so...

Some years ago there was also an hilarious "invasion" of the Chinese servers by euro/US people, with patching the Chinese client to put it in English and using some stolen Chinese citizens national ID numbers in order to be able to subscribe... See http://failheap-challenge.com/showthread.php?1733-Serenity-C...
Nothing wrong with null pointer exceptions - they are specific checks to see if the pointer is valid and are a good thing. If you see one, it means the programmer made a mistake and the runtime caught it for him.

There are also tools to help with it in the form of @NotNull, @Nullable, etc.

It's a completely different issue compared to actually accessing memory in an undefined way as you can in C. The bounds check you are replying to is manually creating something like that exception through the use of abort() while in java it is done always at the cost of some performance in exchange for safety.
I just needed a hobby to keep me from getting bored and depressed. I had adapted a screenplay and made plans to write a novel, but my interest in programming had been sparked by an early exposure to Super Star Trek and the profound realisation that this illusion was being created by a magical recipe.

I wanted to learn these arcane incantations so that I could fill this black void with my own Universe. Whether it be CRT, LCD, LED, or Plasma, I have been trying to find a way to bring worlds of light to the darkness of a computer display ever since. Yet, as the scale of my endeavour dawned on me I realised that it would be better to spend a couple of years creating tools that I was comfortable using than rely on C++ as others recommended.

Unfortunately, my estimate was out by an order of magnitude.

Some twenty years later I have only managed to wrangle the process of research and (re)design to a point where I am finally ready to write a comprehensive specification of my multiparadigm "live" programming language and its alternative document-centric graphical user interface only after a self-imposed deadline made at the beginning of last month - otherwise, I'm sure I would still be amusing myself exploring endless "rabbit holes".

Despite this delay, I feel that my project is stronger as a result. I really didn't know enough about computer science when I started and I have found that I need to grok OOP and FP to know that they aren't appropriate for my needs. I was denied the opportunity to study the subject at school and had to travel to Foyle's in London to buy obscure computer books for years before unlimited broadband became affordable. Admittedly, I was paranoid that I would find myself several years into programming my videogame only to discover that "high productivity", "spare me the details", programming language was weak in some respect and could not accomodate the retrofit of some unanticipated, but very necessary, feature. Hence, a lot of the work I have done has been defensive: trying to create a future roadmap that specifies how concurrency and parallelism would work even if I plan to leave the implementation of these features until much later.

Hopefully, it won't be too long before I am using an integrated suite of development tools (created with my own language), to build my own procedurally-generated intergalactic MMORTSFPSRPG (Massively-Multiplayer Real-Time Strategy First-Person Shooter Role-Playing Game), or "adventure" if you prefer. Without my language/tools I very much doubt I would be able to complete such a grandiose endeavour unaided, and I very much prefer working alone without social expectations or professional deadlines - despite how much of my disposable income it has cost.
I disagree.

These are complex to make robust, but they are not hard concepts. I think everyone should write their own GC, write a filesystem, and handle their own memory layer, at least once.

Treating lower levels of the stack as "too complex, there be dragons, just write some Javascript that hits RESTful API for JSON" is a great way to ensure you never progress as a software dev or an engineer.

I agree that reinventing the wheel poorly - without understanding geometry or physics - is a terrible idea. But I also think that we don't have enough people nowadays making toy wheels to learn about geometry and physics.

For each of the things you mentioned, there are concrete and good reasons why they grow complexity: filesystems need to be robust to media corruption and power faults; memory allocators need to be highly tuned to OS and architecture memory layouts; GCs need to be optimized for the code patterns of the particular language they serve, as well as understand the same OS and hardware memory constraints as allocators.

But much of the complexity of these layers is not intrinsic to the problem, and not related to the above. In fact, most of the complexity and bugs of production code at these layers have to do with legacy compatibility, or code inheritance. (If you look at what Theo says about this specific OpenSSL bug, it arises because the OpenSSL team wrote their own allocator that doesn't use malloc() protection bits because those are not compatible across some platforms.)

As the old saying goes: in science, we advance by standing on each others' shoulders; in software, we stand on each others' toes.
Thanks for pointing it out, all the fun and irony aside I bet someone might not get it, so I think we should be responsible and make it explicit that you should never, EVER post your private key anywhere. If you click "Check" it says:

"Why on earth would you post it here? Now it's surely not."

SERIOUSLY. THIS IS A JOKE.
DONT POST YOUR PRIVATE KEY ANYWHERE.
> no need for tinfoil hat theories

Unfortunately with the Snowden disclosures, there isn't much that I rule out of bounds for the NSA when it comes to things critical to internet security. OpenSSL is so widely used and critical, it would be silly to think that it would escape scrutiny by the NSA.

For example of NSA efforts in related areas (which I figured you would already know): http://www.cnbc.com/id/101301261 http://nation.time.com/2013/11/04/google-shocked-the-nsa-hac... http://www.reuters.com/article/2014/03/31/us-usa-security-ns... https://www.techdirt.com/articles/20130909/11430124454/john-...
To quote Ted Dziuba:

"Anyone who ever told you that swear words have no place in technical discussion is right. They're right, and sadly, they're part of the problem because they miss the point. The sterile word placement that's supposed to support an argument makes any true motivation indistinguishable from all the hired bullshit.

[...]

However, when someone starts swearing in technical discussion, showing emotion, that's a strong indicator that I'm about to receive wisdom. Wisdom is earned the hard way, and it is permanent, not like some statistically shaky performance benchmark that we'll all forget about next week."

I feel the same - I'd rather have people feeling passionate about their work and use swear words, than work with polite non-personalities that don't give a fuck.
They say you shouldn't write your own crypto either :)
It's a massive open source project that's more than 15 years in the making and supports a massive range of architectures and ever-moving standards. Shit happens, we need to figure out how to make sure it won't happen again at this scale, there's really no need for name calling.
I use it as the DNS for my domains actually love that service.
Free $300 gifts Simple, Elegant, Modern, Classic or Vintage Style Gown
We understand the importance of finding the perfect bridal gown for your wedding day. We are proud of our reputation in offering outstanding service, unrivalled expertise & a warm, comfortable, friendly and unhurried atmosphere.
Happy Wedding Planning
YZ Fashion & Bridal
You can also visit my awesome stores at:
http://www.yzfashionbridal.com
http://yzfashion.storenvy.com
http://bestfashiondress.storenvy.com
http://weddingdressesgown.com/

Call us at +1 (213) 986-5869 , Email us at: info@yzfashionbridal.com

YZ Fashion & Bridal Inc
Britain builds robot to test military equipment, suits for armed forces
There are quite a few alternatives (you may also want to look at matrixssl, polarssl/tropicssl and cryptlib), but if you use one of them, people will report interop problems as bugs in your code.

Been there, done that. Sad to say, but I now use openssl.
Great - this has gotten me seriously interested in learning Meteor! Nice work .. and now I've got yet another web framework to learn .. ;)
It does scroll in Chrome. However, you have to scroll for a bit before anything beyond the scrollbar changes.
Ask HN: Any plan to prevent connection to heartbleed vulnerable site by default?
It would be nice if my web browser would prevent me from going on any site with a vulnerable version of OpenSSL, the same way a warning is displayed when a certificate is not valid as it would prevent people from thinking their connection is secured while it is absolutely not.
Also, it would be nice to prevent connection to any site with a certificate that was not generated after the exploit was made public (maybe except if it is in some whitelist for websites that we are sure never used a bad version of OpenSSL).
I guess it would be possible to do so using a browser extension (anyone working on that?) but it would be even nicer to have it built-in in every web browser to protect everyone even non tech people. So if anyone from the Chrome or Firefox team is reading this, it would be awesome to do that ! It would be a big step forward protecting us from incompetent sys admin.
Show HN: Sweet Angle – Write AngularJS directives with ease
Growth Hacking at the Guardian
Ask HN: Can you ‘tinder’ your career to the next level?
Check out phk's fosdem talk[0]. I've linked to the the part where he talks about openSSL, but I'd suggest watching the whole thing. I'm now starting to believe the talk wasn't a joke at all...

[0] https://www.youtube.com/watch?v=fwcl17Q0bpk&feature=youtu.be...
I'm in the same situation, but my FON router sits behind my main router and isolated from my internal network. It still shares Internet access just fine :)
If there are so many problems with OpenSSL, why are there no alternatives that are readily available and anywhere near as functional?

The whole internet runs OpenSSL, but why hasn't anyone tried to do something different? I know it's complicated, but if a few big companies really chose to put some muscle behind it, it could happen, right?
Cryptography Could Add Privacy Protections to NSA Phone Surveillance
This is pretty much proof that open source fails to maintain security software in a responsible way.

Look kids ssl is not that hard to implement.

Time to let the cargo cult go have a campfire and sing songs.

This is too important to leave to lazy paid for nothing programmers who want to write lazy ass c code after too many beers.

Grow up
"OpenSSL is not developed by a responsible team" is downright benign compared to "OpenSSL is written by monkeys".
Has Pingdom jumped the shark?
For VR you want 120 Hz, to avoid motion sickness and you need 2 images.
Found this little tidbit while reading an article about the Cal. drought.

Additional info on the Sensor network SNOTEL:

http://en.wikipedia.org/wiki/SNOTEL

And meteor burst communication:

http://en.wikipedia.org/wiki/Meteor_scatter
This is surprisingly the case for lots of craftsmen in all fields. You may enjoy The Mundanity Of Excellence, by Daniel Chambliss, about how ordinary Olympic swimmers actually are. http://www.visakanv.com/blog/2014/01/the-mundanity-of-excell...
This is a very interesting perspective on neural networks, is it novel? I've never seen a geometric interpretation of NNs.

In particular this:

> (Apparently determining if knots are trivial is NP. This doesn’t bode well for neural networks.)

Is there any theoretical research on obstructions to NN learning? Not that it would change much the practice (for instance, MLE learning of gaussian mixtures is NP-hard, but everybody does it anyway), but it could shed some light on the geometry of the "hard" instances.

EDIT: for example, to get a sense of how ill-conditioned is deep NN learning, a recent paper [1] shows that if we feed to an object classifying NN an image with crafted but unnoticeable perturbations the predictions change completely.

[1] http://arxiv.org/abs/1312.6199
You have kept up to date with the news, right? Truecrypt, RSA... OpenSSL is low-hanging fruit by comparison. Of course it's back doored - probably more than once.

You're right that it needs cleaning - it needs a full audit. I'm surprised in the light of the Snowden revelations that none of us have suggested this sooner, but hindsight is a bitch and all that.
Stuart Parkin awarded prestigious Millennium Technology Prize
Oh, nice.

I even almost managed to find a copy of my old "mystery" mail (mystery because I've been unable to find in the archives, even though I know it has to be in there, as evidenced by the old print-out I have):

http://veps.hypertekst.net/misc/anon-remail/

Did find the thread, though:

http://cypherpunks.venona.com/date/1996/03/msg00168.html

Any chance I could get a copy of the full archive? (Email in profile in case you don't want to make the raw archives available over http).
I think the important part of the previous comment is "At a first approximation" - of course there is nothing wrong in writing code with the primary goal of personal understanding, but re-inventing the wheel when there are potentially very serious consequences for others is hubris (unless, of course, you have a really good reason why, NIH not being a good reason in my book).

[NB Ken Shirriff's blog articles on Bitcoin are a superb example of someone coding in an effort to understand a system - but I don't think he is attempting to write a real Bitcoin library]
Regarding the NSS CVE-2014-1492: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-14...

Quote: "The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate."

Edit: Added Quote
Great resource, thanks!

[From someone else who's not seen it before]
Collecting and storing all that data indiscriminately is the wrong approach for preventing online crime. We don't chip and tag everyone 24/7 to prevent RL crime, either.
And then we'd have potential exploits both in the daemon and in the safe language runtime/compiler.

There is no silver bullet for this. One just needs to keep on looking for exploits and keep on patching them.

However there is a lot that can be improved on OpenSSL side. I hope they change their memory allocation strategy after this.
This sums up some of the difficulties with the production of open source software:

https://en.wikipedia.org/wiki/Public_good
260 Million pixel camera, anyone?
Lots of people have suggested it. Very few people have dedicated their time to helping do it, though. Welcome to the 'other people should do this' club!
RFC 6520 and the OpenSSL Heartbleed bug share the same author
I find it scary the git commit bd6941cfaa31ee8a3f8661cb98227a5cbcc0f9f3 which added support for TLS/DTLS heartbeats, was written by Robin Seggelmann <seggelmann@fh-muenster.de> who is also one of the three authors of the RFC 6520 specification.

The "payload" in RFC 6520 is extremely bad design from a security perspective, it fulfils no purpose, a bit suspicious someone with brains would deliberatly add unnecessary complexity to the SSL procol, which is already a monster.

Even more scary, the spec clearly points out "If the payload_length of a received HeartbeatMessage is too large, the received HeartbeatMessage MUST be discarded silently.", but someone the author of the spec failed to remmeber this when writing the OpenSSL implementation of the very same spec. Highly unlikely.
Tech
If you need help with your tech and gadgets then come to my Youtube Chancel and I can help you out with my great reviews, comparisons etc.
Show HN: 8000 commits later......
And we're live!

http://cloud306.com/

Have fun! :)
You have an easy time understanding the libraries of your native language, but a hard time understanding the libraries of a language in a completely different paradigm that you're a beginner at? You don't say.

Seriously, the Haskell libraries are understandable and informative - once you learn the language.
Clickable link http://cloud306.com/

All your feedback is highly appreciated.
Notifications are a UX Anti-Pattern?
There's a typo in your README, I think the last exception mentioned should be MissingSettingException rather than MissingGroupException.
This book is not free by the way: http://www.heatonresearch.com/book/programming-neural-networ...
Ask HN: YC Application – 0 Video Views
Our application still has 0 views in the introduction video. With just 6 days away from the results, I am inclined to think we are not gonna be in the shortlist.

If you were rejected in one of the previous application cycles, did you also have 0 views? If yes, this could be a good way of "getting the result before its announced" :)

All the best to everyone who applied!
I am sure its good and all but it doesn't end in "nix"
A great API for healthcare related solutions.
How certificate revocation (doesn’t) work in practice (2013)
Kickstart it ?
Extremely bad and practical : http://cr.yp.to/antiforgery/cachetiming-20050414.pdf
IETF already has chairs that work for NSA, which they refuse to get rid of.
The discouraging of everybody who wants to provide an alternative only locks us in to supershitty software that got there first. Worst is Better reigns.

I mean, there is an extremely small chance that anybody will adopt your library if it is unquestionably better than the dominant alternative. We don't actually need to discourage people, we need to do everything to encourage them. Sure, 99 of 100 will be no better than our present crap. What does it matter? Few will adopt it anyway. The tragedy is that the better alternatives will probably meet the same fate.
How would one compare/contrast D vs. Rust? Both concerning the problems they try to solve / the niches they target, and the way they choose to solve them.

I almost never heard/read something about Rust from a D developer and the other way around, it's a bit like they live in different parallel universes :)

There was an interesting discussion on a golang thread about Go vs C++ vs D, with great insights in conversation between Andrei Alexandrescu and some of the Go guys (can't remember where to look for the link right now...), but it only made clear the fact that Go and D target very different niches and it was basically an apples to oranges comparison... but D and Rust would be an interesting comparison, they really are in the same "zone" but the communities seem very different and each seems not to know or care about what the others are doing (there was a Rust guy on that thread mentioning the way Rust uses the pointer types system for memory safety and the others were something a long the lines of "can a type system really be used for that?!" that clearly suggested the two groups didn't share their ideas a lot).

EDIT+: this might be the link to the thread I was referring: https://groups.google.com/forum/#!topic/golang-nuts/8k59Rgke...
Grep doesn't read every byte.
I'm amazed by how many people's reactions to this are shouting about how irresponsible it is. I don't see the author saying that he's decided he'll never work again, just that while he has enough in the bank to cover him, he's going to pursue other interests.

Someone with the experience he clearly has should at the very least be able to get a job pretty quickly should he need to, so why not embrace being able to choose not to work for a while?