skysight-inc/HackerNews huggingface dataset:
Why bother? There are a million different ways to own servers available to the security services that require little to no expertise, from compromising the engineers, the physical servers, the CAs, or plain legal intimidation. Even if the NSA had heartbleed they wouldn't have needed to use it.
So illegal downloading is a "liberal" thing really?; if someone has been hurted by it is indie labels and film-makers for whom realizing an artistic vision was once at least a bit profitable. Not the big fish who still can make money producing shallow generic crap for the masses and can take the damage of a huge statistical slice that doesn't pay for it.
If I were going with a cynical thought, I would think this is a move to get dropbox into government contracts somehow.
In Canada, which is culturally very similar, the typical lunch break us under 1 hour. in some strict places it's 30 minutes. People rarely go home for lunch. usually they bring lunch to work, or buy it, and eat in a common area.
Another example would be Bloom language.
Here is a great talk explaining motivation for using "disorderly" languages in distributed systems:
http://vimeo.com/53904989
and what you replace it with ?
Hey, it's not like they're storing people's data or anything. Privacy just shouldn't be that relevant to them.
I would agree that any attempt to reassign google.com ought to raise someone's eyebrows.

But I would have said the same about mit.edu and they got reassigned about a year ago. Obviously not for long, but the damage someone well-prepared could do by owning google.com for just 30 minutes is scary.
20 Words That Have A Totally Different Meaning For A Developer
https://groups.google.com/forum/#!searchin/mozilla.dev.secur... for example (3 years old).

The right keyword to search for is OCSP, because CRLs are completely impractical in the browser.

But then we have the issue that OCSP is a pretty retarded protocol. OCSP stapling helps with some issues, but there is still the issue that it doesn't really check if a certificate is valid, but whether a certificate bearing the given serial number is valid. Which didn't help AT ALL when using MD5 collisions people managed to create multiple certificates under the same serial number.
OwnCloud, while not perfect, is really easy to set up. I had it running on a Droplet from Digital Ocean in about 20 minutes, and a Raspberry Pi in about 40 (note - it's a bit resource heavy for a Pi)
I ordered something online yesterday, and checked the cipher settings. Turns out my bank doesn't have PFS, and a well-known French payment provider (Paybox) even uses the insecure RC4 cipher.

If the browsers let users who click on the padlock know that it's insecure, the providers would have an incentive to upgrade.

For Firefox, people have reported bugs:

https://bugzilla.mozilla.org/show_bug.cgi?id=956744

https://bugzilla.mozilla.org/show_bug.cgi?id=947149

but they don't seem to be getting much attention. Hopefully Heartbleed will help speed things up.
I am also considering cancelling my Dropbox account. However several of my clients use it to share designs with me making that tricky. Can you suggest anyway around this other than asking the clients to use Google Drive/Box instead?
You elected a president who selected a vice president who voted for the war (Joe Biden). Why are you speaking up now? Because she's a Republican?
A number of people have been bit by issues in mongo in the past such as: the approach it had taken to write locking, that it has silently discarded writes in certain cases, the charge that it uses inflated storage on disk, and the performance characteristics when the working set does not fit into memory. I'm sure there are more but when it arrived it had great marketing as was touted as the greatest thing since sliced bread. Unfortunately, some people ended up with horrendous sandwiches and remember the awfulness of said sandwiches.
I mean, a single instance (perhaps one more) is hardly a "long history" or "repeated issues".
But can't this happen to any db system? Mongo is pretty new and I'm not surprised things like this happens from time to time until the kinks are worked out. The new version of Mongo looks pretty good as well.
Damn.. I'd forgotten about that.

I'll definitely consider hosting my truecrypt volume elsewhere once my two years of free 50gb is up..
>Besides, her technical skills and understanding of IT for sure are awesome, making her the finest choice for Dropbox business.

Is this sarcastic? I can't tell.
About as much proof as the poster above him.
The comments thread is magical.

"I would feel ashamed of myself if I was part of bullying Hitler out of his job at Mozilla" ~ESR
Markov chains help a lot in making the output look like the real stuff, that's kinda their purpose in this case. Heck, there have been automatically-generated conference papers that have been accepted and went through peer review (although this might tell a lot about that process, too ...).

git manpages are apparently full of very git-specific terminology and quite dense. I would guess the same model applied to the J documentation would be equally unreadable for the uninitiated. If the source material was more readable and easier to grasp the automatically-generated versions would reflect that (to some degree, until it's obvious that's nonsense).
Moore's Law hasn't slowed innovation. The cost of fab toolsets and the cost of chip design are the culprits.

Many cutting-edge tools (etchers, deposition, others) now come with price tags of >$5M. A new 200mm fab can easily run north of $4B. The relentless trend of feature size shrinkage is still happening - some designs are underway using 16nm FinFet technology - but at the cost of increased power consumption and increased cost-per-transistor. I believe it was Nvidia that put a shot across the bow of chip manufacturers by saying they saw no economic advantage in chasing the lastest process node.

A clean-sheet-of-paper microprocessor design can easily hit $50M in expenses before the first chip is seen. Much of that expense is sheer manpower & verification processing cycles - a billion transistors' worth of real estate is worthless unless you can run a test suite against it. If you're spending >$50M on a new design, you'd better have a locked-in customer. Projecting that amount of investment for a squishy market like a new consumer electronics widge is the surest way to get your project killed.

Running a microprocessor at ever-greater frequencies doesn't help either. First, you're cooking your chip. Frequency = heat. Second, every processor vendor in the world is limited by the processor-memory chokepoint. You can't read data & code from memory into the processor(s) fast enough to keep the processor pipeline full. And the gap is widening.
+1. Extra-credit if you've heard of cron.
I'm dropping Dropbox forever.
Not be picky or anything. What precisely is the language error? I read the sentence and understood the meaning conveyed.
Believing it != directly lying about it. You can't rightly hold it against someone that they were misled.
If it wasn't for message boards most of those commenting would never do a damn thing, hell with comment boards they don't have too.

Its easy to be the cool, caring, and tough guy, around the internet water cooler.

Angst ridden techie hipters!
Just wait till you have been told - it is running too fast so the client won't perceive it as a "serious" software ... slow it down.
http://www.hackerschool.com
Heartbleed vulnerability may have been exploited months before patch
Without looking at the facts? Guilty until proven innocent? Good for him for convicting others of war crimes without any due process?
Ask HN: Why the bad password policies?
I'm rotating my passwords and just ran into Bank of America's password policy: no symbols allowed. Turns out they're not the only ones -- there are banks that still restrict lengths, too, and go on the record defending 8-character limits (!!!):

* https://www.google.com/search?q=banks+bad+password+policies&oq=banks+bad+password+policies

* http://arstechnica.com/security/2013/04/why-your-password-cant-have-symbols-or-be-longer-than-16-characters/

These companies obviously have teams of intelligent people working on security, so why do they write extra code to enforce bad policies? There must be some reason.
Is there any Mac software that actually uses resource forks these days???
In a similar situation but I've used HTML/CSS extensively in the past with some PHP experience. My plan is to take some time off this summer and study Python full-time while working to build an idea. Hopefully that will get the ball rolling and I'll figure out what to do from there.
Valgrind alone wouldn't have caught this bug. You would also need to trigger the bug, which would involve either specifically testing for it, or sending randomly invalid requests hoping to hit bugs.

Granted, security software should be tested against invalid requests.
For the sake of argument, swap out 'NSA' for any large state actor - it's silly to ask this specifically of the NSA and most of the attention is around them because of the Snowden leaks.

Now, would a large state actor involved in offensive black hat hacking have known of heartbleed? I think the answer is likely yes.

Any decently funded team with a dozen good auditors to commit to the project would be watching popular open source projects like openssl, linux, chromium, firefox, apache, nginx, gnupg, openssh, boost, gmp, berkeley db, qt, gtk, etc.

For this part of the project, you only have to grep for low hanging fruit in each new patch that is released for each project, that is usage of: gets, scanf, strncpy, strncat, memcpy etc (or the equivalents for each project that has wrappers or handling functions).

Any large state actor with any decent team running such a project would have discovered heartbleed within days of it being committed. They also would have discovered a lot of other bugs that we either don't know about yet or have fixed.

With heartbleed the state actors are kicking themselves either way: either because they didn't know about the bug and missed it, or they did know about the bug and now can no longer use it as effectively.

"They" (and you can include black hat groups that don't disclose in this as well) combined likely have more resources dedicated to uncovering these bugs than what the open community does, and it might be an order of magnitude larger.

When you think about this further, you realize that the state actors having discovered heartbleed or not doesn't matter - what does matter is that they do have a lot of exploits that we don't know about and it has been confirmed that they are not only looking for these bugs and have a lot of people working on it, but are actively discovering them, using them and purchasing them on the market.

The response to this shouldn't be heartbleed specific - it should be what do "we" do to stop "them" from discovering and using exploits from open source and projects. There needs to be a heck of a lot more effort or a whole new approach to defeat the level resources that are out there dedicated to uncovering and not disclosing these exploits.

The best thing that could have happen did happen: heartbleed was discovered and it was disclosed, and a hell of a lot of people are now more aware of just how frail some of this infrastructure is and what the risks are.
I don't know how much of an effect this will actually have. It will be interesting, though. The SV mob was strong enough to affect Mozilla, but a service as huge as Dropbox might be mostly immune from the mob cries. They have lots of equity outside of the HN crowd and Rice is taking a board seat, not an executive position.
In places with the most migrants (Amsterdam), the long-standing Dutch tolerance and liberal values aren't at risk or being tested.

Areas with nearly no migrants and no long-standing tolerance or liberal values continue to have no migrants and no tolerance or liberalism.

A few very poor areas with poor populations continue to suck for both 'migrants' and 'native Dutch', as they always have. Both sides and a few opportunist populists overplay these areas. This situation would exist if the 'migrants' were Muslim, Catholics, or Rastafarians, because it really isn't about values, but instead economics and racism.
Pointed out elsewhere, but ANI appears to be dead according to its own tutorial[1]. However Funnel[2] by Martin Odersky/EPFL does a similar job, with a more explicit nod to Petri nets which are usually used as the basis for concurrent systems.

[1] https://code.google.com/p/anic/wiki/Tutorial
[2] http://lampwww.epfl.ch/funnel/
Agreed. With Condi comes access to all sorts of government entities, and the contacts to make those entities work in favor of whatever Dropbox needs them for.

This appointment smacks of the corporate-political complex. It's practically inevitable that USG resources will be used in favor of Dropbox's business at some point.
I wrote this about 2.5 years ago after I career changed myself

http://mattdeboard.net/2011/11/23/how-i-became-a-programmer/

There are a couple other entries there about this general topic.
nah, totally serious

/s
It may be impossible to distinguish genuine bugs from bug-backdoors, which is why it's important to start developing crypto in safer frameworks and languages. C considered harmful.
You're overreacting. Rice is not a "normal person" whose political beliefs I disagree with.

She was one of the architects of a useless war that resulted in the deaths of hundreds of thousands of people. I understand that in large organizations individuals may not be able to stop the machine, but they can always choose not to be part of it.

She is one of only a few people in history who have had that much influence, and who have used it to such devastating effect.
Agreed with the above comment about having a passion for it.

Build stuff, a lot of stuff. Most of it will be bad, but it will start to get better, AND you will start to develop speed in the form of mental patterns for getting things done. Some of those patterns will eventually change as your mentality shifts from "just getting things done" to "getting things done well" to other concerns. Software is largely a set of tradeoffs.

I think getting things done is understated because it also means learning to deal with ambiguity in features/ideas/specifications/product. This can cause paralysis for some.
Isn't this kinda related to "Black and White Thinking" / "All or Nothing Thinking"?
I don't disagree on these points. But the reality is you are talking every person who has worked for either administration in the post 9/11 era is on this gig. We still have guantanomo bay...etc. None of these people in washington are changing anything. The snowden leaks are from 2008-2009 era. That stuf is 6+yrs old. People thought that was tin foil. For 6 years...
I was not aware that existed! You've just made a lot of people very happy, thank you!
God am I ever a cynic. The first thing I thought of immediately was government tampering and the NSA, and that was my only and immediate thought.
That's great. I've been meaning to learn a bit more about Rust, maybe now's the time.
http://en.wikipedia.org/wiki/Condolezza_Rice#Iraq

http://en.wikipedia.org/wiki/Condolezza_Rice#Role_in_authori...

The facts have been on the record for years now. She's guilty, but there will never be a formal trial specifically because power will never turn on one of their own if there's nothing to gain.
Why? What does she bring to the table?
It's time for Ubuntu to re-evaluate its decision to shut down Ubuntu One
That's not true. The LGPL explicitly allows closed-source programs to incorporate it (that's why it's the LGPL and not the GPL). The problem is that the LGPL is incompatible with certain use cases (embedded systems, I think the App Store, possibly the various consoles) so Unity can't distribute LGPL code to those platforms.
Innocent until proven guilty, as long as you didn't work for the government?
Chelsea Clinton has never even stood for office, much less been part of the senior leadership of an administration that led the US into two wars of aggression and endorsed torture.

I really don't see how a vaguely rational person could even begin to compare the two, regardless of political beliefs.

I haven't seen anyone arguing that Bush was worse than Obama in this thread, so I don't see how that comparison has anything to do with anything either.
Many indie artists have chosen to release their music for free as piracy lowers the bar for them to acquire a broader fan-base. Similarly indie filmmakers want their films to be seen. They still generate the same amount of money they would anyway from die hard indie movie fans who attend indie theaters.

Both do better with more people being aware of them and their content being seen or heard by more people. And, they are not the ones who are going to afford the types of lobbying and legal prosecution that it takes to go after their downloaders.

The only people benefiting from these laws are the very large studios which continue to pull in record profits year after year. The people hurting is everyone else.
Even today, HTML5 games won't function properly across all modern browsers without using Flash via soundmanager2.js as a crutch to get around unacceptably poor audio tag implementations.

In particular, the audio tag implementation in Safari makes pure HTML5 games range from annoying to unplayable, because there is a completely unavoidable 500 +/- 1000 ms delay between calling play() and the audio actually playing through the speakers.
How is Condoleeza Rice joining Dropbox, make Dropbox vulnerable in the hands of big brother than it already is? I do think it is a bit of an over reaction to move out of Dropbox solely because of this reason. In these days of Prism, we should assume that most of our private stuff is available for surveillance, unless we are ready to pay for a trusted fully encrypted (without de-deplication) sharing service.
That seems directly counter to the goal of her helping them expand internationally. The person behind that legislation doesn't seem like the person who'd talk China etc. into opening up.
The problem is not that bugs happen, but that certain categories of bugs still happen when we have means to avoid them altogether.
Hypothetically:

File Manager -> Settings -> Remote storage -> add remote

Choose from:

dropbox,
google drive,
skydrive,
others...,
other (some open api)

Select > Authenticate > Mount points > Bring online

Something like that would be nice.
The generator doesn't use markov chains, it's grammar-based similar to the Dada Engine which powers the postmodernism generator. There's a link to a markov chain based generator in the footer, check it out, it's pretty funny and a lot more random.
I agree, that's probably what's going here.

But the thing is, a lot of this stuff works quid pro quo. What might happen is, USG will pay Dropbox a nice penny to use some of its service... aaaaaand in exchange they also set up a deal to snoop on Dropbox users.
https://www.dropbox.com/account/delete

Reason: Other

Care to elaborate: Condoleezza Rice
And yet, President Obama selected Joe Biden as his vice president, who also voted for the same war. Hillary Clinton did too, and she's the leading Democratic contender for 2016. Why no outrage? Because they have a D next to their names?
Their S-1 filing doesn't inspire a lot of confidence.

They literally wrote under "Risk Factor":

We have a history of cumulative losses, and we do not
expect to be profitable for the foreseeable future.

http://www.sec.gov/Archives/edgar/data/1372612/0001193125141...
I didn't vote for Biden, and I didn't forget his pro-war stance, either.

Biden wasn't just appointed as a board member for a relevant tech corporation, though. If he was, I'd be up in arms, too.

That said, even so, Biden's role in promoting Iraq was far less than Condi's. Additionally, Biden didn't specifically push for advanced interrogation techniques AKA torture. Condi did.
Code reviews.

It surprises me that something as important as OpenSSL doesn't have hundreds of coders studying every check in to find potential bugs, in particular obvious C errors.
Cheers threepipeproblm. I tend to hit www.reddit.com/r/technology/ which overlaps with here. And individual blogs. Great suggestions. I will add them to the list.
Stow the butt-hurt.

I've looked at the facts. The Iraq and Afghanistan wars will be remembered as the end of the American era, unless Silicon Valley can build US 2.0. and disassociate themselves from Washington.
I cancelled both my accounts over this. It'll be a personal pain, as everything on my ipad hooks in nicely to dropbox, but it's worth it in order to not support one of the Bush era war criminals.
Facebook Removes Messaging From Its iOS, Android Apps
Nothing included in Atom was convincing enough to switch me from Sublime but no cross platform definitely hurts.
Hate to break this to you, but Wikipedia is not due process.

http://archive.is/vAWQa
To me, one of the most important things to learn in web development is to learn about the HTTP protocol.

This may sound boring and tedious, but if you don't know how GET, POST, PUT, DELETE etc. work then it won't do you any good trying to wrap your head around frameworks.

Learn some of the common responses and what they mean and are typically used for (200 is ok, 302 is a redirect, etc).

REST-style frameworks are just abstractions on this protocol, and a good understanding of it will help to make sense of why web dev frameworks are built the way they are.
Yeah there's a pretty large class of data processing tasks that are made pretty trivial by LabVIEW-likes visual dataflow languages. One I've seen for XML work that was pretty good was called "SDE"

http://www.futurepointsystems.com/?page=products
People move physically and change their phone numbers, too.

You don't have a bad idea, you just need to consider all the effects.
Agreed. It's hard to understand HN sometimes. Posts about women and minorities in tech get overwhelmingly positive comments..."we have to do anything and everything possible to get more of minority X involved in tech"...then a popular company hires a double minority and everyone loses their mind.
And? One approach doesn't invalidate the other.
Well goddammit. And here I was, about to completely switch from OneDrive+Google Drive to Dropbox.

Now I have to pull everything out of Dropbox and put it... somewhere. Google Drive, maybe. Sigh.

I hate leaving negative comments like this, but I really can see no positive light to this development.
I would like to see some true backing for that. There are so many cool indie productions out there it's hard to imagine it was once even better.

Also I cannot imagine those indie movie makers profiting much from robber baron constructions like BUMA STEMRA, all indie music makers I know personally really hate their guts and feel stolen because they are forced to pay their fees to play gigs or press vinyl but never ever get a decent kick back.
Varnish 4.0 Released
Very sad. I just deleted everything from my Dropbox and my account, sent them an email saying "I do not do business with war criminals."

Good luck Dropbox, I hope you un-fuckup somehow.
Common Lisp also supports specialized type declarations like this. (In Common Lisp type declarations are optional.)
May I suggest adding a link to the http://platform.qbix.com in your README.md
We're not talking about Obama. I would be equally offended if he or one of his defence / intelligence cronies were appointed to Dropbox's board.
Oh yeah. Erlang or not it teaches a lot of very useful principles -- fault isolation, building distributed system, functional programming. Those can be applied to general system design.
EBay ends war with Carl Icahn
Weren't John Kerry and Hillary Clinton arguably equally responsible for any war that Condy supported? The voted for the funds that made it possible, how is that less responsible for the results?
Do you have a source for this? I just did a quick google search, and although they're somewhat comparable, DO outperformed Linode. And the tests were for read-only, not writes. I'd wager that writes are much faster on an SSD.