skysight-inc/HackerNews huggingface dataset:
I will admit that Lewis has rustled my jimmies. But if he's interpreting this "punching in the balls" as a good guy punching the bad guys, he's mixed up. Electronic trading is the present, and it should be the future. In fact, every market that still exists as a network of people calling one-another or standing in a pit would be made many factors better by opening them up to the public and allowing trades to take place on electronic exchanges.

I get scared of what Lewis is saying in the same way it scares me when I hear of school districts banning the teaching of evolution. I'm not scared that Lewis is right. I'm scared that his misinformed screed will actually gain traction.
But seems like only the http connection is working, i get a warning in Chrome when visiting https://cloudflarechallenge.com. Isn't that the only situation where the key would be checked. That's the part that doesn't make sense.
So what? Depending on whether they're simply hosting public information and there's no need for authentication, why would they need SSL?
Cloudflare's Heartbleed challenge has been solved
Legality: http://www.radarbusters.com/radar-detectors/stateradardetect...

More importantly, a cop seeing a detector will often pull you over for the fun of "gotcha." Being HN, here's proof. My ex uni roommate is on CHP in Martinez. Copy & paste from iMessage: "LOL, definitely" Mostly, it's cop psychology is really all that makes the difference between getting hassled and not.
Los Angeles wants to become the largest city with free Wi-Fi
There are other implementations besides OpenSSL.
That's immaterial though. The questioner knew the answer was classified, so it's not as if that was a surprise, because the questioner was a member of the Select Committee on Intelligence. In other words, he wasn't asking for his own edification, he was asking in order to force Clapper to either lie or break his oath by divulging the secret. Even saying "I can't answer that" would be an admission for the same exact reason hacktivists give a shit about warrant canaries.

But whether Clapper objected or not, Sen. Feinstein apparently got an inkling the question would be asked, as she made clear at the start of the session that there would be a closed hearing immediately afterward for questions that couldn't be discussed in an open forum.

And since Wyden and Udall both knew the actual answer, if they were so convinced the answer should be made public then either could have simply put it in the Senate record thanks to their Constitutional privilege and taken the risk that would come with that. Instead the risk was shifted entirely onto the public servant who didn't have Constitutional immunity from prosecution.
If they're using their edge to reduce the bid/ask spread of the retail customers to a penny instead of the 25 cents or more that it used to be, how is that hurting retail customers?
We ate them.
One feature you can start using right now: prove an assertion with the WP plugin. [1] It's especially useful to prove the absence of some undefined behaviour, bounds on variables, or invariance conditions.

[1] http://frama-c.com/wp.html
https://github.com/openssl/openssl/commit/bd6941cfaa31ee8a3f...

Amelek is being a bit harsh or just plain wrong; I learned a few days ago that checking malloc's return value means almost nothing:

https://news.ycombinator.com/item?id=7541585
>> “What is true,” says Lewis, “is that the sums of money involved — if you spread it across the market — are trivial, it’s a penny a trade. But it’s offensive as hell that rich people are stealing from middle-class people — even if it’s just a penny. There’s also the issue of what HFT does to the stability of the marketplace as a whole. And then there’s the question of the whole screwed-up model it creates for success in life, when the guys who get rich do so by skimming on the market, so all of a sudden the young people at the best schools want to go skimming in the market — like that’s a noble career path.”

>> “I don’t understand that argument. The little guy is the big guy. The little guy is not the day trader on eTrade; it’s all the money packed up in pension funds and college endowment funds and mutual funds. The savings of the country is in big institutions.”

Michael Lewis seems like a solid guy and I love how there's endless attempts to portray him as a sinister, self-interested actor.
Can someone explain which part of the code contains the bug and why it is a bug?
> Since then it could be argued that VCs direction has changed to investing the 3rd party pooled money into businesses that are employing some novel technology or processes.

The information technology (IT) VCs are essentially
hopeless at the crucial work of evaluating the
"novel technology". The US DoD, NSF, NIH, and DARPA
are quite good at such evaluations.

> VCs typically have employees who are familiar with industries, business, and / or technologies to help identify candidate investments as well as to help said investments to flourish.

For good exploitation of technology, what you are
describing is not nearly good enough. The IT VCs
need very much to up their game to whole new
levels. They need, say, to be able to do or
at least direct evaluations of anything
that arrives in their e-mail
in IT that might make a big pot of money,
and they can't and won't do that.
I don't think anyone has an issue with electronic trading. It's high frequency trading that has a lot of people (including myself) very worried.
Perhaps you missed the part of the drama where it was revealed years ago that OpenSSL prefers to roll it's own malloc rather than work out issues in their code that were exposed when porting to other platforms? OpenSSL would just have rolled their own shit to circumvent whatever protections you think other languages provide.

It's the attitude that was wrong, not the language. Stupid always finds a way. Back in the day, porting to different compilers and platforms was one way to find and quash bugs. Nowadays I guess you can just pitch a single OSS compiler and rely on it's implementation details and bugs. Drag your own chunks of libc around and presto, no porting headaches. That's such a stupid attitude.
They could clarify. Besides, it doesn't look like there is any form of SSL being used. Correct me if I'm wrong.
> this is not really news for a lot of people.

As a counterpoint, the fact that the NSA was monitoring electronic communication wasn't "news" either.

Shifts in opinion and popular consciousness is often times a matter of momentum & critical mass. This book will probably do more to stimulate popular interest in this issue than just about anything that's come before it.

As a side note, I'm currently reading Flash Boys and have previously read Dark Pools. So far, I would definitely consider the Lewis book to be the better of the two.
Same here. I was trying other ways in instead of Heartbleed, and made no progress. On the positive side, I wasn't expecting Cloudflare to be vulnerable to a timing attack anyway.

EDIT He won't reveal it for a week. Good on him. https://twitter.com/indutny/status/454790640078176256
Try https://www.cloudflarechallenge.com/
Cool. So you'd be interested in being an agent. Can you expand on your ideal user experience?
Samsung's big bet on Android actually a covert strategy to replace Android
Subdomains are separate domains, and you put www.cloudflarechallenge.com in your hosts, so when going to the domain without the www subdomain your entry in the hosts is not used.

Either go to https://www.cloudflarechallenge.com or remove the www subdomain from your hosts entry.
Try setting 'www.cloudflarechallenge.com' in /etc/hosts instead, and when visiting the URL hit <shift>-<reload> to ensure your browser isn't caching anything.

I see Indutny's blog for 'https://www.cloudflarechallenge.com'[/etc/hosts mapped to 165.225.128.15] in both FF and Chrome.
Nice post, thanks for sharing!
consider yourself corrected.

https://www.google.com/search?q=site%3Awww.icc.illinois.gov+...
>This isn't about delaying details to anybody

Yes it is. If you disclose early to a select group, you are by definition delaying details to everyone else.

The paid early disclosure stuff used to exist all over the place, and it was a joke in terms of it being immediately leaked to those in the know.
We absolutely do not want this. We rely on the goodwill of a lot of really smart people to produce the open source security software we rely. Even if the person who introduced this bug did in fact conspire with the NSA, we would do far more damage by going on a witch hunt. The majority of people working on this software are well-intentioned and if contributing to open source means that they risk being subject to a witch hunt for their contributions they will be far less likely to partake.

The only reasonable course of action is to apply oversight of the NSA. If people in open-source are moles, the only reasonable way to discover this is via oversight of the agency. If there are moles, there are records within the agency showing this to be the case. Getting ahold of those records is how you prove this and you get those records by getting congress to do their job and provide oversight.
That was a rather transparent straw man argument you came up with there. Lewis is not against electronic trading. And he is certainly not trying to bring back the pits. He is against high frequency trading, or the ability of some insiders to obtain an advantage over the ordinary investor.
Somehow I totally missed your bounty offer. Not that I was going to win if I had seen it, but where was it mentioned?
Wow, that's neat! Has any of this technology made it out of the lab?

It feels like the main limit to mass production of this technology (if people wanted it) is the cryogenics system involved. What other barriers (other than lack of demand) are there to, say, placing a superconducting device in a mass-market product?
Are you referring to decimalization? If so, that doesn't really have any direct relation with HFT. The NYSE famously used to list prices in fractions of 1/8th, and converted to the decimal system around 2001.

edit : coolio, I misunderstood the parent's comment.
All of humanity descended from a single female 100,000 years ago, so every other female from that time didn't have any descendants alive today either...

http://en.wikipedia.org/wiki/Mitochondrial_Eve
Electronic trading is the present, and it should be the future.

You know HFT isn't identical to any electronic exchange, right. I haven't evaluated in great depth whether Lewis is correct or not. But I'm pretty sure you can't defend HFT solely on the basis of "this is inevitable" (after all exchanges makes elaborate and special allowances for HFT, it's not a strategy you can sit at home and do). Any market is based on rules. If, for example, every transaction, no matter how quick or small, involved a small fee, I don't think HFT could exist as it does now.

Again, the point isn't that I've prove HFT should be banned but rather that like any other construct, it needs to justify it's existence rather than talk about inevitability - sort of like you defend patents if you want but you can't defend based on property rights.
People seem to be missing that they have a private account part, protected by ssl, probably for services aimed at business owners. That's the reason for this notice.

And the author of this thread's title is wrong, the fact that they don't use OpenSSL does not mean they do not use SSL at all (as proved).
That's just for signing in. Perhaps SSL isn't really necessary unless signing in, but I would still think it could facilitate malicious script injections.
(at least) in a comment near the top in the hn annoncement thread for the challenge
So if the one particular strategy Lewis describes in his book -- inter-exchange arbitrage that inadvertendly beats someone's split up order -- was stopped/prevented, is that the end of it? There are many, many strategies across a million different products that HFTs run that have nothing to do with trying to "front-run" someone's order, many of them market making a product that only trade on one exchange (so no inter-exchange arbitrage to front run anyone) on products that trade an order of magnitude more dollar volume than US equities, e.g. E-mini S&P futures, US or german bond futures complex, etc. Are all HFT strategies bad, or does Michael Lewis have a hard on for this single, particular strategy? My guess is that the overwhelming majority of profits of any HFT firm do not have anything to do with the particular strategy described in his book.
That could mean anything from "there was a typo" to "there were factual omissions that were unknown to the author".
Don't know why my benign comment deserved a down vote. Just thought I'd say something positive.
Ethereum: A Social Operating System
Looking around the site, it appears that they do use SSL for parts that require authentication. They may simply be using a different implementation of SSL.
Foobar Mobile Kickstarter
What do you mean inadvertently? No way is that by accident.
In D, which has ptr/length arrays, strings are immutable and sliceable without copying. This can make them very fast.
One benefit is that more releases means fewer changes in each release, which means when something starts to go wrong, it's easier to figure out what happened.

But of course there's a limit; you don't want releases that are so quick that you don't collect enough data about the effects of each release.
The phrase "hits back" implies he somehow addressed the arguments against him, as opposed to merely saying "yay publicity".
Realize that people who sign in on the "commerce comission" website are probably business owners who don't want their sign in information (or other stuff this web site might have from them in their account) to be leaked
When one exchange's offer or bid is taken out (fully traded), there is no guarantee that the same offer or bid will continue to trade on all remaining exchanges. If you took out the remaining shares on all remaining exchanges every time any one exchange's offer or bid traded out, you will lose money -- I've tested this exact strategy before.
You're the one misinformed here. He never said he's against electronic trading. In fact, IEX, the very firm he champions, is an electronic trading firm. He's against he practice of exchanges like BATS getting kickbacks from HFT firms for sending orders to them at inferior prices, screwing over institutional investors in the process.
> How do you not love this guy.

Me? Insane jealousy.

(Although I do like that he made me google up the X-Men And Teen Titans cover art to confirm the source of his Twitter pic.)
The faster way of doing this:

def fourier_transform(signal, period, tt):
""" See http://en.wikipedia.org/wiki/Fourier_transform
How come Numpy and Scipy don't implement this ??? """
f = lambda func : (signal*func(2*pi*tt/period)).sum()
return f(cos)+ 1j*f(sin)

is using the FFT.

What you want is the power spectral density in the discrete case, called the power spectrum. It can be calculated by multiplying the discrete Fourier transform (FFT) with its conjugate, and shifting. NumPy can do it. Here is an example: http://stackoverflow.com/questions/15382076/plotting-power-s...
According to the source they seem to be using the ASP.NET/IIS stack, which uses Microsoft's SChannel SSL implementation which is not vulnerable to the OpenSSL bug.
Isn't separation of powers meant to prevent such things?
That isn't quite the right way to put it. For example, if Eve's daughter reproduced with Phillis's son, Phillis likely has some descendants. The chain of mothers ends at Eve though.

Edit: changed phrasing a bit.
Tangentially, the particular construct you describe ("transaction tax") has proved it is not worth it. Canada tried it out.

http://qed.econ.queensu.ca/pub/faculty/milne/322/IIROC_FeeCh...

It hurt the little guy, raised costs, and allowed the big guy to more easily hide their orders.
Even if I'm not submitting authentication credentials or other sensitive informtation, if I'm looking up something at a .gov I'd like to be sure I'm actually talking to the real website.
How could this security hole be any worse?
Passwords, Credit Cards, Personal Information, Private SSL Certificates!???
And without anyone knowing at all.
This is just crazy.

Bravo to indutny for pulling it off in 3 hours.
I love APL!

I am a student of k and now q.

The biggest problem of the shell is the rules around quoting. That includes whitespace but also many other snafus.

As for all the utilities being geared toward line-by-line (newline delimited), this is true.

But quoting can be learnt with practice; I rarely have problems because it is second nature.

And, there's a shell utility called lex. It lets you design your own utilities (filters).

And you can create filters that read multiple lines, easy as pie. (Easier than mastering awk.)

You can even create your own programming language by combining lex with another standard utility: yacc. This is how C was created.

Do they still force CS students to learn about these utilities?
About a third of the internet uses IIS which is not vulnerable to this bug.
Umm, all week he and Katsuyama have been in the media addressing the criticism, e.g. the CNBC debate [0].

[0] http://www.cnbc.com/id/101544772
Well,

One could argue that giving someone latency for money is an inherent disservice to every other investor - whatever strategy you are following, you're getting opportunities before everyone else. One approach would be to have exactly one kind of connection to an exchange with a fixed delay level that everyone has to live with. Another approach is to have a small on every kind of transaction (Edit: other claim HFT pay a small fee and I am no expert but it's clear one could decrease HFT by raising transaction fees).
New Revolutionary FDM 3D Printing Process Will Soon Be Available For Public Use
>As for "the occult" in D&D, come on. Throwing a die to check the damage of a fireball never turned anyone into Aleister Crowley.

I meant that D&D contained occult themes, not that it presented these ideas as factual or encouraged people to take them seriously. A fair reading of my post would have indicated this anyway, since my post started with "While the idea of teenagers literally worshiping Satan was a moral panic..."
it's a nightmare for crankshaft.
Ubuntu One is shutting down
DDOS THESE IPS 199.216.46.204 AND 192.168.200.2
There could easily be a spousal visa.
No, he's referring to the lower bid/ask spread that HFTs cause.

http://qed.econ.queensu.ca/pub/faculty/milne/322/IIROC_FeeCh...
Why Teams are Lazy.
Well Bernanke certainly has political opinions, as do many other Americans, so I guess it is best to avoid these bloodthirsty monsters.
http://news.cnet.com/Some-H-1B-workers-underpaid,-federal-au...

"Those certifications represented far less than 1 percent of the approximately 960,000 H-1B applications approved by the U.S. Department of Labor between 2002 and 2005"

Sorry, that's terribly weak sauce for an argument.
Do you really think I claim to know how much space drop box freed up or that I propose in reality the reason they hired Rice is to free that space up?

You seem to want to argue so let me indulge you....

I postulate geeks are more likely to use Dropbox's free service than non-geeks. Why?
1) They are better informed of alternative options and thus less likely to pay as they can spread their files out over multiple free services.

2) They have less trouble implanting multiple file storage options. Non-geeks are more likely to be intimidated by this and thus pay for the "name brand" and "what they know" option.

3) Geeks are known to be cheap. (ok... say "Cute" again).

4) I can keep going if you want.

I think all this pretty clearly indicates my original point was valid. And this ridiculous thread indicates someone needs to spend less time on the computer and stop picking pepper out of flypoop.

As for hiring Rice... ya, that seems like a bad idea on Dropbox's part.
Every transaction does have a small fee. In US equities, there is an SEC fee of 22.1 dollars per million dollars sold, and for most (all?) futures exchanges, where HFT is just as prevalent, there is a fee both for both sides of a trade (unlike the maker/taker model in US equities).
Do you guys store passwords in plain text? Shouldn't you only be able to get password hashes from a vulnerable server? I might be reading too much into your statement, but I'd like to know if I'm misunderstanding the situation.
My issue with this bill is that it ignores the crucial function of NTIS as a library. That is, an official source of these documents with a responsibility to maintain, categorize, and retain them. Various other public sites have no such responsibility.
It's entirely material as to whether it was forced. Clapper knowingly permitted himself to be in a situation where his only options were to break one of two laws. He can't then use that as an excuse. He chose to break one of those laws when he chose (when reviewing the questions) that he was going to permit the question, and he's plainly guilty of breaking the law.

"And since Wyden and Udall both knew the actual answer, if they were so convinced the answer should be made public then either could have simply put it in the Senate record thanks to their Constitutional privilege and taken the risk that would come with that."

Agreed, and I would think more highly of them if they had. I'm not sure what the game was. That still does not change the fact that Clapper is guilty, though.
I was thinking the same thing - I had never heard of that tool but I will def. use it in the future
The important thing to know here is that you not only have to change your current certs you ALSO HAVE TO REVOKE THE OLD ONE.

If you only change your current cert to get a new key but you don't go through the revocation process of the old certificate if someone managed to get the old one they can still use it for a MiTM attack - as both certs would be valid to any client.
I'm curious how that number has changed for people in the cars versus people hit by the cars.

I would imagine that the rate has dropped precipitously for people in cars, but has been rising for those outside the cars.

FWIW I've been hit twice as a bicyclist, both were the fault of the driver. One turned into me while I was in the bike lane and the other tried to overtake me and clipped the front of my bike dragging it under the front tire. I was very lucky both times.
Nobody said that it would help find it in testing. You're attacking a strawman.

Edit: although that is also false if you are using a quickcheck-like testing framework.

Edit2: the article may have been claiming that, but Ted did not claim that, nor did Theo.
Stuck in Tijuana hoping for a miracle: the deportees with nowhere to go
Ok adding www to the hosts entry worked, appreciate it
Folks interested in HFT might like this - HFT firm Virtu has a nearly flawless daily trading record over the past 3.4 years:

http://www.businessinsider.com/virtu-hft-only-one-losing-day...

Prospectus:

https://www.sec.gov/Archives/edgar/data/1592386/000104746914...

Looking at the S&P 500, it was positive for 55.8% of the trading days between 2010 and 2013:

http://www.crestmontresearch.com/docs/Stock-Yo-Yo.pdf

BofA had 10 trading day losses in 2013:

http://blogs.marketwatch.com/thetell/2014/02/28/goldmans-tra...

US equity HFT revenues are around $1.3 billion, making it a pretty small niche compared to wider market activity: "TABB Group estimates that US equity HFT revenues have declined from approximately $7.2 billion in 2009 to about $1.3 billion in 2014."
Also, cert revocation just barely works, in some browsers, with EV certificates, after old CRLs expire over a course of months:

http://news.netcraft.com/archives/2013/05/13/how-certificate...
...obtain an advantage over the ordinary investor.

Big investor. If you are a retail investor, the HFTs don't know about you until after your 2 lot trade is finished.