skysight-inc/HackerNews huggingface dataset:
Eventually, the bad guys will find all of these bugs

That's not really true. The NSA has incredible resources that other bad guys do not.

I think a critical step on this logic chain is "once we find all the bugs, we will be safe." Given that step, you would obviously want the NSA to tell the vendors about every single bug they find.

But it's really not the case that we will ever "find all the bugs." Even if the vast resources required were needed to be spent to find all the bugs in version 3.1415, there would be new bugs in 3.1416.

I can kinda-sorta buy the full-disclosure argument that "if an independent researcher can find X then so can the bad guys." That argument doesn't apply to the NSA. They have a much better reason to believe "we found this exploit, and it will take a long time for someone else to find it out."
It would be cool if this was a website (or maybe simply a subreddit?) instead of an HN thread which will disappear in a few hours...
If you clicked on the 86446f74

You would have gotten: https://github.com/expressjs/body-parser/commit/86446f74d5c6...

Which shows parents 0
I just deleted my Dropbox account. It was a free account anyway.
I found it contained about GB of files I hadn't accessed in a couple of years.

Then I realized....

What a wise move on the part of Dropbox to bring Rice on board. They probably will free up a few Petabytes of space from non-paying geeks:)
However, the software being open source aided those who may have rushed out to take advantage of still-vulnerable systems. It's a mixed bag both ways, lets not put blinders on for ideological reasons.
Why is this here? This is nothing a thinly veiled political rant which creates an impression without any actual evidence. Find a real story with facts and maybe it's interesting.
"The only way to reconcile their thoughts and actions is to explain that, in fact, they must really love this job and therefore should work hard at it"

That is not the only other way to reconcile their thoughts and actions. They can beat themselves up for not taking the money / regret their choice ('I am so stupid for not taking that money, I hate this job'). I know plenty of people who beat themselves up on a regular day to day basis about all sorts of life choices they wish they had made differently.
Yeah NSA's job is to fix open source bugs, whatever.

NSA is a spy agency, expecting them not to use vulnerabilities they find is like sending them into a gunfight with a pocketful of rocks. Ask the Palestinians how that works out in the long run.

I think much of the NSA's surveillance is unconstitutional and should be rolled back by at least 2 orders of magnitude. That doesn't have to entail turning the world over to Russian and Chinese hackers.
There should be a security equivalent to hiring a lawyer to write strongly-worded letters for you.

Maybe someone could set up a firm where individuals could hand them a vuln report, and then the firm would contact the vulnerable company on the individual's behalf. The firm would do the long, boring dance of "we suspect you're vulnerable to X, though we haven't tested it, but we'd like to do a free vulnerability test on you, so please sign this liability waiver", both protecting the individual from liability, and taking time the individual doesn't have. In return, if the company gives rewards, the firm could take a percentage.
The kind of drivers who would buy a license to speed are generally the kind of drivers who should have their license to drive revoked.
I would be willing to take a stricter driving test and have my vehicle subjected to higher inspection standards if I could be permitted to drive faster than the speed limit. Sure, some people and some cars can't safely do it, but why not allow those that can to do so?
I think it's hilarious to see people who are ostensibly zealous advocates of privacy lobbying to get prosecutors to subpoena the financial records of the people who invest their free time in building privacy-protecting software.

I am at the same time comfortable filing this under "things that will never happen".
> CHL

Please don't use cryptic acronyms. Not everybody's from Texas.
There's a fine balance here; speed isn't necessarily a problem, but speeding in the wrong places/at the wrong times. It's all about driving to the given conditions, which sadly many people do not do.
Oh, so it's a barrier-to-entry argument? That makes more sense. The barrier to doing something with postgres is pretty low, so competitors can more easily copy your ideas unless there are more barriers somewhere else.

An interesting point. More broadly: if what you're working on is not hard (and awkward), then others can copy your idea easily. Technology like postgres makes a new class of problems easy, and thus you need to find new problems to solve if you want a sustainable business.
When I got my ticket in PA they had 4 marked cars on rotation pulling people over. Having one guy who is faster in front of you wouldn't help much. I don't think that situation is typical though.
May I refer once again to http://sqlite.org/testing.html and the fact that it's running in the real world on millions of devices? This is a non-argument in this discussion! What if IndexedDB has a bug which manifests differntly on differnt platforms? You would refer to the specs, which can be tested.
3D Display Uses Misted Water
They do disappear off of your feed in which case you'll never see them again. There is no concept of "unread" tweets, like there is with RSS.
I find it is much easier/safer to aim to go over by small amounts [e.g. I went $34 over, I aimed for $50 over] and avoid that. I can afford to give them a $50 interest free loan, and if they seize it, I'm not going to care too much.
And as Kasparov likes to say: You don't need smart people to run a petrol state. Brain-drain is bad for Russia but good for Putin.
Thank you, this is great. Posting cold to people who don't know the site is not normal for us. We were trying to create a "club of doers" experience - we do everything we can to help the doers who are using the site with their projects so that they share it with other doers they respect and invite others. However I saw several posts that really ask for the problems we are solving, and felt compelled to offer the site as a resource. We really want to make the landing page experience as clear as possible. I am taking notes. feedback@doerhub.com is also red constantly (I also work until 5 am most nights to implement the updates). Please, write me if you are open to seeing the next iteration of the page as well. Ping me if we can assist you in any ways as well. You guys are doing us a huge favor!
How much time do you save by speeding? To me, speeding significantly, especially for short trips, is futile.

Say in a 20 mile commute, 14 miles is on the highway with a speed limit of 65mph, 3 miles is on a road with a speed limit of 45mph, and 3 miles is on a residential road with a speed limit of 35mph. Furthermore, to simplify this, let's say you only speed on the highway. Going 65mph will result in 12.9 minutes on the highway, going 80mph will result in 10.5 minutes on the highway. By speeding, you exposed yourself to financial risk, and yourself and others to physical risk in order to save 2.4 minutes.

Now, let's say you encounter 6 stop lights on your commute, each with an average red light time of 1 minute. Let's say on average, you get caught in half of them each time you make the trip and that there are no backups requiring you to stay at any given light for more than 1 cycle. So your average red light time per commute is 3 minutes.

You've now spent more time waiting at red lights than you have saved by speeding on your commute.

On long trips, speeding can save you hours instead of minutes, so it seems more justified. But for a savings of 2.5 minutes that can easily be negated by red lights or other drivers? Why put yourself and others at risk for such a small reward?
I remember wincing when I first read the transcript. Weev was his own worst enemy at that point, and as he proceeded to fall apart on the stand, his testimony become more and more damaging: at best, he came off as evasive, sarcastic, and arrogant. From there, it was as easy as pie for the prosecutor to paint him as having something to hide. An impression which, unfortunately, weev actively contributed to.

It's not fair, but there's a reason why most defendants don't testify on their own behalf: they are, almost always, seated too close to the matter and unable to come across as objective.
Anything OpenSSL decrypts surely has to hit the OpenSSL process's memory, right? That would include requests, which could easily contain sessions, passwords, etc.
Ask HN: Why do Chrome and Firefox only support SHA1 for cipher suites?
I want to shut off all crypto methods that are a security issue on my company's web server. We use nginx.

We have a 4096 bit RSA key, signed with SHA256, use a 4096 bit dhparam, have only TLS 1.0[1] and up enabled, and use !3DES:!AES128:!aNULL:!eNULL:FIPS@STRENGTH for our ssl ciphers.

See the ssltest output for my site to see what various browsers do (scroll down to Handshake Simulation): https://www.ssllabs.com/ssltest/analyze.html?d=exelion.net

Why does current Chrome and current Firefox only support SHA? If I do !SHA in ssl ciphers, no browser can connect due to lack of compatible cipher.

Now, scroll back up to Cipher Suites. I support cipher suites with SHA256 and SHA384, clearly. So what gives? Why doesn't Chrome and Firefox allow those? And if you look closely, they still don't do GCM either.

[1]: It took Android browser until 4.4 to support TLS 1.2, Firefox 24 ESR doesn't do 1.2, all the web spider bots don't do TLS 1.2, MSIE 10 and lower don't do 1.2, Safari 6 on OSX and Safari 5 on iOS don't do 1.2.

Android browser in 4.0-4.3 being unable to do 1.2 is the only reason I still leave 1.0 enabled.
Problem is that "the bad guys" also includes Chinese and Israel intelligence agencies. The Israelis are known to have massive cyber ops going on (Stuxnet is said to have a large Israel contribution), and the Chinese cyber-ops exposed (iirc) one year ago only learned from their uncovering.

I would not be surprised at all if Israel and China didn't also know about Heartbleed.
The NSA has exploited Heartbleed bug for years, Bloomberg reports
Maybe i'm missing something, but restify seems to have an identical API to express
Trade's influence on the two Koreas in one dramatic map
Building modular applications with Riot.js
You can turn on 'anyone may DM me' in your profile.
If only I could get access :(
Considerably more clear. For some reason the linked article also keeps changing font size, like a badly copy-pasted email.

The money quote, for anyone wondering how they can collect debt on people's children:

"The Federal Trade Commission, on its Web site, advises Americans that “family members typically are not obligated to pay the debts of a deceased relative from their own assets.” But Social Security officials say that if children indirectly received assistance from public dollars paid to a parent, the children’s money can be taken, no matter how long ago any overpayment occurred."

That seems like very tenuous legal theory, as it seems like it could apply to any debt the parent accrued, at least while they had dependents.

I'm curious if this has gone through the courts before, but unfortunately this seems to be in one of those legal loopholes of civil cases, that you don't have a right to defend yourself in court before they take money from your refund, and in order to bring suit, you have to prove you have standing, which most people don't have for decades old debts of their parents...
spot on.

[edit]
Ok, thanks for the down vote on an article that hasn't got much rating and up votes.
By the same token, you could argue that investment screws up the software market, because companies operating at a loss hire employees they couldn't otherwise afford.

Again, a: they cannot sell at a loss at scale, and b: venture capital is invested with the expectation of building business model infrastructure, not being a fly trying to beat whales on cost. If they're actually blowing VC money on underpricing commodities like food rather than hiring programmers and marketing, their VCs should be ripping them a new one.
Oh, there is a link for the bug. Sorry, my bad.

Yes, Privacy Enhanced Mail is not part of the verified PolarSSL configuration. And the bug at https://github.com/polarssl/polarssl/issues/83 is definitely the sort of bug Frama-C would “not shut up” about, as Regehr puts it. The warning will only occur where the buffer overflow eventually happens, and it may be more or less pleasant to go back from the site of the buffer overflow to the bug in the fashion of http://blog.frama-c.com/index.php?post/2014/02/23/CVE-2013-5... , but Frama-C's value analysis is designed to reliably find this bug and not shut up about it.
Is it so vaguely undervalued or does it just work so well that it does not need too much improvement?
Who is "familiar with the matter"? NSA insiders? People who've read the Snowden docs?

I wonder if Bruce "probability is close to one that every target has had its private keys extracted by multiple intelligence agencies" Schneier is one of them.
The US government seems intent on destroying the viability of the Internet as a commerce platform.
A sponsored bug bounty might be just as useful as more money directly to the project (especially if Google is porting Chromium to it). The nice thing about sponsoring a bug bounty is that anybody can do it; it doesn't require coordination with the project.
Wow, I'm surprised that someone that's so crucial to the well being of so much of our internet security is funded on $2000/year in donations. I think I'm going to start donating more to stuff like this.
LBGT rights advocate and prominent Twitter engineer charged with rape
You can scroll down. The latter is true.
At the National Air and Space Museum reception during Washington DC EduCom in 1988, I took a big bite out of one lobe at the bottom of a three lobed red bell pepper so it looked like an alien's face, and held it up to Steve Jobs, and said "Earthman, give me your seed!"

He looked at me funny, but I couldn't tell if he got the reference to Bizarre Sex #10: http://silezukuk.tumblr.com/post/3151672333 [NSFW]
If that's true, then they will find out why it's a losing strategy when they run out of money, and their VCs will hopefully learn not to fund companies whose business model starts with loss-leading commodities against established market giants.

But I find it hard to believe VCs are that stupid.
As mentioned in the previous thread: https://news.ycombinator.com/item?id=7572911 (direct link: http://www.doerhub.com )
Box Debuts ‘Box Open Source’ To Share Its Internal Tools
And yet, many popular users do exactly that. I'm a huge proponent of keeping metadata, which is what hashtags are, out of the data. It sucks but, making your message "discoverable" pollutes your message.
>I doubt how anybody can claim they're "driving safely" when the only observer is oneself and there is no baseline to compare against.

Don't we all get observed and evaluated by a driving instructor before being licensed (think about what that word means) to drive? I'd say that meets your criteria
The trick is to put yourself in the context of a potential leaker. Is this person technical? Would they have the skill to distinguish between heartbleed and another equally powerful exploit? What "at least two years" means to me is not that they knew specifically about heartbleed shortly after it was introduced, but that there may be another equally damaging bug the NSA exploits that a non-programmer could easily confuse. After all, I'm sure they don't have this exploit labelled "heartbleed" in their database.
Note the almost painfully predictable response to the thread. Instead of focusing how OpenSSL can pull in, let me pick a number, $800k in revenue in the next year, they immediately zero in on $70 of Paypal fees as the organization's leading financial problem.
Gogo Signs Up with Boeing
>> Well, if you were keeping all the code to yourself you presumably wouldn't be accepting poorly reviewed patches from random people.

How does this follow? You can just as easily hire "random people" to make mistakes as you can accept mistakes from people you don't pay. The problem is poorly reviewed code either way. Not the license.
OK, help me out here...

If I understand the heartbleed bug correctly, isn't there an RFC that it is implementing? Does the RFC say that you can ask for a length, and you get that length? That is, isn't this really a bug in the RFC?

If the security flaw's in the spec, there's not too much that the programming language can do to help you. The best it could do is point out that you're overrunning a buffer, at which point the programmer has a choice: Proceed to implement the spec in code that is declared to be unsafe (useless), scream about the spec (the right answer, and useful if anybody listens), or find some other way to generate the extra bytes that are supposed to be in the reply (which makes this implementation safe, and still satisfies the flawed spec).
Hold up, do you think I actually want the scenario I stated to happen?
Slightly unrelated:

So I am foreigner living here with greencard for just few year, so I might miss something. After filing my fifth tax return this year I was wondering - why I need to spend an evening at all doing copy/paste from paper forms I receive in the mail, when IRS receives same forms? I.e. why IRS can't just send me a bill or a check if they already have all numbers? I understand there might be some issues with self-employed people, but I think majority's income is reported on W-2 or 1099 forms. And for minority who is not part of these reporting could be required to go with some additional calculation.
CHL is the Texas concealed carry license.
> It's perfectly possible to drive very fast without driving badly

I do get what you're saying, and it's clearly true on some level, but your statement rings all kinds of alarm bells for me, most notably that almost everyone considers themselves a good driver, and many feel that their skill justifies that they be exempt from the rules. But people are terrible judges of their own skill, and I would urge anyone who feels justified in driving outside the normal speed range to seek independent verification that their driving skill is outside the normal range.
Concealed Handgun License.
Also known (depending on location) as a Concealed Carry License, Concealed Firearms Permit, etc.
So it's a new paradigm and it's different this time?
Varies per cop though. Some cops don't like the idea of being bought out, so you can really piss them off.

It certainly isn't nearly as bad as what I've seen in other countries however... where you simply pull out a few (hundred) pesos and the cop lets you go.
As a hobbyist, I'm curious: other than what the markings say (value and tolerance) and an estimate of power capacity, what would you expect the interviewee to be able to say about the resistor? Assuming you're not interviewing in a lab.
>That doesn't have to entail turning the world over to Russian and Chinese hackers.

That's exactly what they do when they allow bugs like this to continue to exist, rather than working to fix holes, not exploit them.
"It works even if I don't pay for it."
>that all characters within a node in the rope have the same length [...] I'd also treat a character + combining characters as a single character.

The problem with this is that Unicode doesn't restrict
the number of combining marks. If your hypothetical library wants to offer full Unicode support, your "nodes of same length" idea wouldn't work.

Of course an implementation which makes an arbitrary restriction wouldn't be unusual. In fact, I'm not aware of any application that supports an arbitrary number of combining marks even if the standard allows it.

When it comes to standard conformance UAX15-D3 [1] is probably the closest we could get. It'd require 128 byte per character.

[1] http://unicode.org/reports/tr15/#Stream_Safe_Text_Format
Speaking from experience the 11-99 is as much a badge of bullshit honor amongst "serious" car enthusiasts.

Like I not only have a Porsche I have $2500 and I am a serious racer.

If pricenomics had presented one piece of actual data vs conjecture this would be compelling but barring that this is just linkbait and probably good marketing for more stupid vanity license plates just like the la times article they reference
34000 is a record low for the past 40 years, btw.
Most blue collar workers turn over in a year, so this is just PR fluff. Companies can and do write them up at any time for the smallest of mistakes and then fire them, often within the first three months. Any statement made about a manual labor job and "After the first year" is ridiculous as is the tuition plan.
The point is that there is a lot less to destroy on a barren freeway than a residential area filled with pedestrians and property.
== Help Me Out: Try out https://wsend.net

wsend.net is an easy way to send files from the command line. Trying to figure out how to get more people using it.
Tell your friends about it / Tweet it out

== I Can Help:

* Someone to talk to

* node.js, Python, PHP, MySQL advice.

* A ride / drink / hangout in the NJ area.

a-at-abemassry.com
App.io Turns iOS Apps Into Playable Mobile Ads
I've starred your JWD project. Always on the lookout for a good writing program. :)
Lots of education: Conferences, teacher training, student scholarships. Also, selinux.
"They must be, because the markets are too large to be subsidized by VC forever."

cough Salesforce cough
I'm not so sure, I know plenty of people who don't realize that until it's pointed out to them. Even then, many don't even care ("I don't have anything important anyways...").
Yep, that's what we call Appioception...
Yes. Asked for advice from a couple of people but can't seem to decide yet... Good thing I have until April 30th.
Apple has THREE TIMES as much cash as US govt, TWICE the UK
HMO:

I am nearing completion on an OSX productivity app aimed at helping busy project-oriented professionals (e.g. sales people, consultants, portfolio managers, attorneys) and college students deal with context switching by giving rapid access to diverse types of related information.

I'd greatly appreciate any of: beta testing, feedback, or advice on marketing.

HYO:

I'm a solid copy-writer and proof reader.

My email is in my profile.
Diff for OpenSSL Heartbleed bug fix
We don't have plans immediately.
https://supporters.eff.org/donate

They make it easy to setup recurring donations. I'm sure even a small amount every month makes a difference.
Way to quote by stripping away the context. Have you not been paying attention too? To things like history of Crimea or its geographical location, for example?

The question remains - what will invading Ukraine, strapped in debt and with nothing to offer, give the invaders to be? The brainless hysteria surrounding this situation is absolutely ridiculous. It's twice as ridiculous if you'd remember that Russians and Ukrainians generally treat each other as close relatives. Annoying at times, but still same blood basically. There are radical nationalists on both sides, but that's marginal. Just look at how Ukrainian team was welcomed at the Olympics - with an ovation. And how things were unfolding in Crimea - with flash-bang grenades and blanks.

It's not about Russia threatening Ukraine. It's about Russia paying back US and EU for stirring shit in Ukraine to drive it away from Russia. This is all macro-political. Ukraine is just a casualty caught in a cross-fire.

--

Have I been paying attention? Yes, I have been. Have you though?
Can you copyright a license plate frame? I'd love to make a bunch of these things and go hand them out to low income minorities, those people deserve a break from the cops for once.
I think In My Experience (earlier in this thread) is a pretty standard one, but I agree about CHL. Especially since it is Texas specific.
Well, that's where some of our magic comes in :) I'll see if one of our techies can shed some more light on it for you.