skysight-inc/HackerNews huggingface dataset:
It's probably common in technology area that due to Dunning-Kruger effect many super talented engineers have low self-esteem and real-life skills, and are attracted by "magical" personalities, forming narcissist-codependent pairs. I see it all around, it's sad, but unless engineers fix their broken "insides", it's going to happen.

Nailed it. Most of the Silicon Valley hotshots are those who've become extremely adept at exploiting talented people with low self-esteem.
"just large enough" is impossible, you'll always over-allocate by at least 1 byte, and then to get the actual best precision you have to read the input data a byte at a time, performing a read(2) per byte. That's both slow and less readable.

You can do this. First allocate for and read the fixed length part, then determine the length of variable length part and finally allocate for and read the variable length part. This may of course still return less data then expected and leave you with uninitialized memory. And you may of course receive a larger buffer then you asked for.

Yes, but that's not the issue in heartbleed. My comment was about heartbleed [...]

Of course, I just wanted to say that zeroing memory may not be sufficient in the general case without bound checking because sometimes people have or get the impression that this would be a good and easy fix.
Yeah, for the name to be feminine it must end in ah/ya sound or a certain class of soft consonant endings, so this pretty much restricts the usual female names to this class. That said you're quite likely to encounter people with non-Slavic names, like Gulimzhan which don't have to follow this rule.
When the announced they had amassed over 1% of all Bitcoins and they had been buying for months, you could calculate their average buy price. I did that and it worked out to be about $10 - $30 a coin.

They won't be hurt for a long time.
You could have a default implementation that callers have to set, eg:

xmlSetFileResolver (xml, xmlDefaultFileResolver);

Callers could provide their own, but most will use none or use the supplied default.

Of course nothing helps for people who code by copying and pasting, rather than understanding what the API or library does.
Embrace the Unexplained
Check the site of the blog post...
Migrating to Express 4
I had to stop reading. I also worked for a micro managing CEO/President and I HATED EVERY MINUTE. Knowing that if you did the slightest misstep or were falsely accused you were fired and there was a morning meeting the next day to tell everyone that so and so was no longer with the company. NO THANK YOU!!!
Why would you want to appear better then you are at the interview? You'll get found out eventually later, and this will end up just spending your time.
I'm not disagreeing.. but lots of people either dislike relying on JS, or would prefer to have the initial page load be a complete page.

If your AJAX is pulling down HTML fragments rather than JSON, then Varnish's ESI gives you the best of both worlds, allowing varnish the gather and assemble the initial page from the same endpoints your JS would hit.
English translation (Google translate)
---
The cases made ​​in the Unified Register of banned information network addresses CDN- service CloudFlare. This is due to the active use of this service sites - Russian law violators . When trying to determine the hosting provider such websites whois services indicate ip- address CloudFlare, concealing information about the location of your hosting provider , providing accommodation in this Internet site.

This complicates the interaction Roskomnadzora with this hosting provider and virtually eliminates the possibility of timely removal of illegal information to regain access to locked resources .

CloudFlare representatives refuse to cooperate and do not respond to legal notices Roskomnadzora .

In the absence of reaction on the part of many conscientious CloudFlare Internet Resources using this CDN- service fall under lock operators on the territory of the Russian Federation.

To avoid such situations , it is recommended to place web- sites on the capacities of local hosting providers who operate in good faith and in a timely manner the Russian legislation restricting access to Internet resources with information dissemination in the Russian Federation is prohibited.
How does selling an exploit to criminals not pose a moral question?
> My parents (mostly my mother) are very religious and I remember being driven around town with the local Christian radio station on and it being just wall-to-wall fear mongering about Satanism, backmasking in rock songs and D&D.

I wonder what the end effect of this trend:

https://news.ycombinator.com/item?id=7535218 [Internet use is associated with non-religion]

will be on these kinds of "generated worries"? Will the fear mongers simply fade away, or will they find some different way to incite fear in others for their own gain?
They are establishing the tone of the relationship .. [& edit: it is a great filter for the personality type they want.]
Show HN: A writing-first app for authors.
Does anyone remember Randall explaining DDOS?
This is basically what Bounds Checking GCC[1] did. Except instead of changing the syntax or using fat pointers, it kept a map of (pointer -> bounds), allowing memcpy to check the bounds of any arbitrary runtime pointer, and to interwork with code that isn't compiled with the -fbounds-checking flag.

[1] https://www.doc.ic.ac.uk/~phjk/BoundsChecking.html
Not that I'm disagreeing with you, but aren't SSL connections rather expensive to establish because of the public key encrypted key exchange? Ofcourse anno 2014 that doesn't matter, but the whole library seems a bit engineered for 1998 when establishing SSL was probably a pretty significant thing.
very cool, I will definitely take a look at this
It`s almost a covalent bond. The same that diamonds are made of.
> what happens when you're in the moral minority?

in the moral minority where people in positions of power think torture is a-okay?

I think you'll find yourself shit out of luck regardless of your past choices in boycotting or not.

It does, however, have a tiny influence on the chances of actually finding yourself in this unenviable position in the future.
thank you, this is the best advice about side projects i have ever read, I'm going to practice this from today!
One time when I attended WWDC all the food served was vegan at the main social event. The impression here is Job's food preferences filter down as a mandate for all. At least in this instance.
The heartbeat extension was originally designed for DTLS, which is TLS over UDP. UDP datagrams don't arrive in a guaranteed order, or within any bounded time. If heartbeat used a fixed message, then if you sent a request and receive a response using DTLS, you would have no way of knowing if that response was a response to that request, or to some other request you sent ten minutes ago, or what.

Allowing the request and response to carry a payload lets you mark each request with a unique identifier, so that you can recognise the resulting responses.

It's basically like an HTTP cookie. In reverse.

I have no idea why the payload is variable-sized, rather than being (say) a fixed 32 bits. I would guess the specifier didn't want to bake in assumptions about how much space a unique identifier would need.
I can explain.

a. It was bought on-campus.

b. If he stopped all donut services because of one guy who looked unhealthy, then it again shows how capricious he was. One person who looked a little unhealthy ate a donut on one occasion and he removed donuts from every single store on campus for every single person for no reason other than he didn't like to see someone who looked pasty and obese walking around eating a donut.

Because that's the sort of guy Steve Jobs was. A sociopath.
Is it possible that they would get more donations if they incorporated as a 501(c)(3)?

Tax deductibility isn't a big reason why I donate to things, but I still thought it was a bit weird that the "OpenSSL Software Foundation" was incorporated as a for-profit company.
So why is Apple not releasing any new products lately - just revamps? Companies are thriving under perfectionist, customer-oriented dictators.
If it can reply whatever you requested accurately, then the established 2-way communication can be said to have the same quality.
Berkshire Hathaway has returned about 800,000% since inception.

Oracle has returned around 80,000% since IPO. Dell, Cisco, Microsoft, AOL, numerous others all pulled a greater than 10,000% return post IPO.

Las Vegas Sands managed around a 7,000% return from the 2009 bottom to recent top.

What do you suppose Andy Bechtolsheim's $100k check / investment into Google returned?

There are in fact plenty of examples in recent history of extraordinary returns on par with or far exceeding that 10,000% level.
http://www.imore.com/debug-11-don-melton-and-safari
> "[Everybody is] going to have cases where they did something bad to somebody, said something nasty to them and maybe regret it later."

> I think that's a more enlightened point of view.

This kind of argument is weak. It's just a bland kind of truism that everyone can agree with that is unrelated to the original argument - when someone says that some one is a bad person, there is an implicit comparison to most people, ie the "badness" of a person is a relative one. Then bringing up some kind of absolute quality - perfection - is just trying to distract from the original argument.
Ask HN: What can we learn from Heartbleed?
Should all other critical Internet libraries such as PHP, Apache, SSH, Linux and Ruby be deeply assessed?
Uh yes, probably a factory is never going to be an optimal solution. If you know what type you need, why would you need a factory to create it for you? Just create it. You might need a generic initializer function that sets various values on the type you create, but there's pretty much never a reason to have a function create a variety of types for you.
Can someone translate the google translate? (obviously even better would be a russian speaker translating/summarising the article)
Gunning-fog index
... crappy experience everywhere.
Your wife seems to be affected by the recently discovered vulnerability. It would be advisable to upgrade her firmware to the latest version.
INVOKE Unpackable Types in C++11
Congratulations on being oblivious to user experience twenty years after even Microsoft got it.
Microsoft? Intel? Google? I think there are a lot of examples.
That and

>The ability to dial somebody directly from the call log.

really baffled me.
Microsoft, Apple diverge on bankrolling big patent buyer
It's great that you chose this license, it is truly selfless to pick the MIT license. Kudos for that. More projects should be on MIT.
Or your reputation or your ethical and possibly legal duty to protect your clients?
I am a user. Am I oblivious to my own experience? :)
I don't see that implication at all.

...I would be quite interested in having a list of their Web services that they don't deem to be 'key', however.
But I heard that discontinuing unstaffed projects was evil?
Recursion: Dream Within a Dream
It's not because of aliasing, it's because of the push_back call inside the inner loop, which may potentially have to allocate (in this case we know it doesn't, but the compiler does not). If you replace squareVec6 with

vector<int> squareVec6(const vector<int>& v)
{
vector<int> result(v.size()); // preallocate
// result.reserve(v.size());
transform(begin(v), end(v), begin(result), [](int i)
{
return i*i;
});
return result;
}

the compiler will be happy to vectorize the loop.
The new thorium design should be the Mega-Joule Operationally Limited Nuclear Incident Reactor.
I'm not sure what kind of coding work you do, but I assure you the vast majority of web development work has little resemblance to coding questions. You are almost never designing an algorithm: that was already done for you by whoever designed the library you are using.

Majority of the tasks IME:

- code reading & refactoring

- figuring out why two libraries aren't playing nice

- bug triangulation

- optimization (not the algorithmic type, but rather the fix-the-auto-generated-SQL-query / frontend asset packing kind)

- repetitive/simple/obvious bits of jQuery

Maybe there's some kind of online test that could exercise those skills, but if you ask me the main performance changers for modern web development are, they're: really knowing the stack (problem anticipation, what to use, how to use the various tools to quickly get search keywords), google fu, and most importantly having done it a couple hundred times (muscle memory).
The type safety shown in the article doesn't come at a speed cost. The times are erased during code generation. The generated C code is much like hand crafted C but with the safety confirmed via the types.
CloudFlare is hosting sites which, according to claims in this article, violate Russian law. CloudFlare is not responding to legal notices from the Russian government (or is not complying with the demands in these notices).

It sounds like they're warning website operators that they will be blocking access to CloudFlare in the future, and that operators should move sites to local hosting providers who comply with local Russian laws.
> The vulnerabilities could also allow remote code execution on a server system running IIS, if that server allows processing ASP.NET pages and an attacker succeeds in uploading a specially crafted ASP.NET page to that server and executing the page

Like he said, this matters if you're running untrusted code from potentially malicious people.
It's not a serious bug if you're running well-intentioned but potentially buggy code, like openssl.
Playing Telephone with Research
Maybe I just read it wrong but it sounds like Google made an opening offer and the security group felt it was sufficient and decided to take it instead of negotiating. Maybe I'm wrong and they'd already given the details and Google was just trying to keep them happy and provide some cash for what otherwise would've been a Good Samaritan, open-source contributor type of report.

As long as Google is willing to negotiate, I don't see a problem with a group being satisfied with 10k and taking it.
> The early 1980s were a really weird moment in American history.

I don't see anything about what you've described (other than the specific subjects of D&D and rock music) that identifies the 80s. The reaction you describe is typical of all time periods; the same thing is happening all over all the time. For some period in the 90s-00s it was violent video games.

http://basicinstructions.net/basic-instructions/2014/2/4/how...
Alternative title: Hagiography of a Dead Psychopath CEO
I agree with you however companies are completely the void of morality their only purpose is profit and they will hire shady lawyers to interpret the law in their favor fire people without giving it a second thought or collude with other big companies to keep their employees wages low so why would i treat them differently.

In business morality is a luxury that some companies can't afford and most choose not to have so it shouldn't be expected.

The only thing preventing you from selling it on the black market is the potential fame and business you may get by being able to reveal your find which may or may not be worth it.

That 10k is not really much of an incentive from a business perspective.
"CloudFlare representatives refuse to cooperate and do not respond to legal notices"

Ha ha.
I wonder if they bother to translate these...
ATS doesn't have a VM. It compiles directly to C. The example given in the article doesn't use a runtime and the resulting C code has no more overhead than the original C.
Funny, I thought it was the discount price that was the cause, Jobs thinking people will only buy later for cheaper and he'll lose profits (I pictured him making money from Apple's cafeteria)
very good advertisement indeed - i haven't heard about their service until today, and am now giving it a try.
Thanks for this. I could never get into supercollider and my own custom MIDI-outputting code never managed to keep time properly.

Now I can write my automatic-jazz-improvisation sequencer!

EDIT: good to see it still has BBCut built into it, for LISPy amen choppage fun.

Now my brain is melting at the thought of recursively defined, lazily-evaluated breakcore. I think I need a lie down.
Most of the time projects are not neatly encapsulated like that.
Compartmentalization is part of that.
Instead of node I would say look at Maven, I never had a problem with a java project that used maven, all I ever needed was maven, and a JDK.

It may not be the best out there but to me seems pretty good considering it is as simple as download source code, and run "mvn package".
> then determine the length of variable length part

That's the part you can't do, you're reading data from a socket, you can't skip around with fseek(3), you read(2) or you recv(2) and if you don't store your data somewhere you lose it.
Article is not very informative. If they don't use OpenSSL what do they use?
From what I took from it the TL;DR would be that Cloudflare are refusing to reply to Russian legal demands to take down sites or materials considered to be illegal in Russia in a timely manner or at all.
The source is not generally accessible from prod servers - only binaries and supporting data, and only the ones running on that computer.

I guess it's possible you could find a computer that hosted both search and the codebase. But, since search is for external and the codebase is for internal, I'd be that they don't share clusters.
At the very least the organization should look at itself very carefully, find out how this this happened.
> I would guess the specifier didn't want to bake in assumptions about how much space a unique identifier would need.

Yep, although an up-to-64KB buffer seems like overkill you'd get a guy getting by on a byte, while the other one has a distributed system and wants UUID or something
How do you AIDA? (attention, interest, desire and action)
"X caused Y" is dangerous when it comes to markets. How do you know the freeze didn't stop a slide to $300?
That's unfortunate. I happen to run a site somewhat popular with some Russians (on a lark, since I don't understand anything), and it has attracted its share of DDoS attempts.

CloudFlare has been a boon here. I don't pay them to speed the site up, nor to hide from the government, I pay them so I don't need to spend any time on these occasional low-grade DDoS attempts.
In the example given in the article there are no run time costs. The generated C code is much the same as the original C code from OpenSSL. There is no ATS runtime that gets included either.
Makes sense. But 64k of data seems oddly large just to ID a message.
Props to cloudflare. What with the number of websites that are using cloudflare these days the public outcry against a ban of cloudflare would probably be heard all the way to Warswaw. It might even have a Streisand effect bonus causing people to wonder what exactly it is that they're not supposed to be looking at.
Probably CloudFlare makes difficult for Russian government to censor certain sites.
Presumably, the static analysis won't find this bug because the 'out of bounds' memory that heartbleed accesses isn't necessarily out of bounds?

As has been explained elsewhere, OpenSSL has a wrapper around malloc() and free() so that it re-uses allocations. This means that the 64k of buffer used to send the heartbeat response is data that has never been free()d and has previously been written to by the process.

To make the static analysis spot this kind of thing, I'd guess you'd have to mark/label the OpenSSL allocators as being 'like' malloc. Likewise, valgrind would also not spot the faults without extra knowledge.
SecureTransport https://developer.apple.com/library/mac/documentation/securi...

Remember "Goto fail?"
Bitcoin would be the preferable way to get payed in this situation.
Russian Communications Supervision commission (roskomnadzor, or abbreviated RKN) is a govt organization in Russia which performs pre- and post-court decision IP blocking of "offending" internet sites. Because the blocking is based on IP, only about 3% of blocked sites (there was an article about that somewhere on Russian internet) are blocked properly and according to the law, and 97% are wrongfully blocked colocated sites on shared hostings.

Now to the essence of the article: RKN is trying to block some websites which are hiding behind Cloudflare from DDOS, and then site owners discovered that Cloudflare also helps them complicate blocking procedure. Then RKN releases an news post asking them to stop using Cloudflare if they are legit websites and work according to the (russian) law, and use Russian hostings instead. Cloudflare does not respond on blocking requests and does not reply on attempts to send them official emails (and why would they?).

Deciding why those websites wanted to use Cloudflare, which is a DDOS defense system, and will not to move to Russian hosting providers is left to reader as exercise.
"But how many of us can get these guys be terrified of us, make them change their lives for our vision and make them give us their complete attention"

I'll list a few:

* Stalin

* Pol Pot

* Shoko Ashara

* David Koresh
In the end, it's all geopolitics. US funds revolutionary Ukrainian groups in an attempt to bring the Ukraine under the US sphere of influence, Russia annexes Crimea in an effort to reinstate its sphere of influence, US threatens visa restrictions on Russian elite, Russia begins to threaten companies that act as extensions of the US on trumped up charges. And so the cycle goes.
For me it’s rucking. I live close the Ottawa River. So taking a backpack filled with bricks, a water bladder and just walking along the river - walking past the Canadian parliament on the left and viewing Quebec on the right – is a very calming experience, despite the weight.
I would never consider selling it on the black market. That others are lacking moral principles is not a justification to go the same route.
How much did CloudFlare have to pay to get this advertisement and endorsement from the Russian Government?
The benefit of npm is that everything is modular and patchable. To me it outweighs the 10,000 files issue.
Jobs wasn't really motivated by money. Not like other people were, at any rate.
"Why would one rationally chose to "sell" this to google instead of the black market."

Exactly because of that. One is legal the other is not
Even before PowerShell, Windows had thousands of COM objects in the system that can invoked within a scripting language like .vbs or any language that has APIs for accessing com objects like ActiveState perl. The Windows Explorer shell, Windows Media Player, not to mention Microsoft Office applications, have object models that are exposed and available to programmed against. I am not so sure that UNIX has anything better, since it seems all the functionality that UNIX has is also available in Windows. Then, there is also WMI (Windows Management Instrumentation) objects for all the low-level system operations.
>I agree with you however companies are completely the void of morality their only purpose is profit and they will hire shady lawyers to interpret the law in their favor fire people without giving it a second thought or collude with other big companies to keep their employees wages low so why would i treat them differently.

Perhaps, but even so, when you sell a vulnerability to the "black market" you don't just harm Google. You also harm people the vulnerability will be used against (to fish their credit card details, compromise their servers, etc).

(Perhaps in this case, for technical reasons you can only harm Google with this thing, not sure. But still, talking in general).
Theo is Sloppy Mo: https://www.youtube.com/watch?v=MnXZB9SkS44
"Sites that use OpenSSL will display a small “lock” icon in the top left-hand corner of your Web browser’s address bar (though not all sites showing this lock use OpenSSL);"

This sentence physically hurt to read. I seriously hope that Google Translate wrote this.