skysight-inc/HackerNews huggingface dataset:
I was just responding to you about pure functions. You can make a Haskell function with a pure type signature that includes a call to unsafePerformIO.
HMO:

I'm building a dating website for kinky folks. I'm hoping to have it ready for launch at the end of the year.

So pretty much, I need kinky folks! Specifically:

(1) I'd like to find a lawyer to be COO / President.

(2) I'd like to find kinky business owners: we have some freebies to give away during launch month, so if you want to provide your customers with some extra goodies let me know!

(3) The site will need some design. Right now we're scraping by with bootstrap and cider.

(4) If you're a kinky person yourself and you'd like to be kept in the loop when the site goes live please get in touch!

You can contact me via reddit. Check profile for details.

How I can help:
I build and market websites.
Which leads me to an important thought: it needs to be easier to find a place to play in your car. There need to be more raceways and race training.

The United States needs a few https://en.wikipedia.org/wiki/N%C3%BCrburgring 's
I'm moving to Boston. I am looking for someone to help me through the ropes. I have tenacity.

wittedhaddock [at] gmail [dot] com
Not necessarily, this might actually be an approved ass-covering leak.

You may think it's awful that the NSA knew for 2 years, and didn't push fixes... but their funders and overseers, in Congress and the DoD, would be more likely angry if, given the NSA's massive budget and mission, the NSA didn't know about this bug right away via code audit/analysis. Knowing vulnerabilities first is the whole job of the "Cyber Command".

And, the best defense isn't necessarily a panicked fire-drill of preemptive patching ASAP, if you're sure you're the only ones who know. It could make tactical and economic sense to simply prepare contingency plans, and wait for the first evidence of a 2nd-discoverer.
What's the main reason I would need to send files from the command line?

If this is for person-to-person sharing, the person on the receiving end has to know the url that I sent it to - how is that normally accomplished? Usually the way that I send files to people is the same way that I would communicate to them that I have sent files, e.g. HipChat, email.
Are you sure we're talking about the same Nathan Myhrvold? Because the Nathan Myhrvold that I know is often referred to as a visionary technology and business leader. (http://www.nathanmyhrvold.com/)

Certainly not the Nathan Myhrvold who is a professional jack-of-all-trades. After leaving Microsoft in 1999, he's been a world barbecue champion, a wildlife photographer, a chef, a contributor to SETI, and a volcano explorer. (http://www.ted.com/speakers/nathan_myhrvold)

You can't possibly be talking about the Nathan Myhrvold who proposed that we pump sulfur dioxide into the atmosphere from helium balloons to solve global warming, despite experts saying that it would reverse all the work we've done in the last 30 years to get sulfur dioxide out of the atmosphere. (http://transcripts.cnn.com/TRANSCRIPTS/0912/20/fzgps.01.html)

Although Google would make an industry outsider think differently, it's pretty much common knowledge within the tech industry that the guy is a complete piece of shit.
It's trading speed for risk of a ticket.

If tickets for dangerous driving were given instead of for speeding, then people might optimize for what is safer, not just what would not give them a ticket.
Formula One drivers have HANS to prevent their necks from snapping in half in those crashes.

Beyond just roll cages and crumple zones... Formula One drivers have far more restrictive seatbelts and safety measures than the typical driver.

The fatality rate for the typical on-the-road driver reaches ~100% at 65mph collisions. With racing-level safety equipment and car design... sure, it can get better. But that sort of stuff is irrelevant from a public safety perspective.
NSA Knew About Heartbleed for Years, Used It to Collect Intelligence
Mac OS X is very reluctant to uses updated versions of OpenSSL. This affects many applications (e.g. Tor.) This script builds from source to force OS X to use the newest version.
A completely botched response from Dropbox.

They had two options:

1. Disregard the concerns raised as those of a vocal minority, while the overwhelming majority of their users are apathetic about Rice's appointment; refuse to legitimize the concerns by publicly acknowledging them and wait for the whole thing to blow over;

2. Acknowledge the concerns as legitimate, and damaging to users' trust in their business; as a business that depends so heavily on the trust of its users, admit an error of judgment and remove Rice from the board.

Instead, they have legitimized and publicized the concerns, but are refusing to do anything about it. They're going to get a kicking for this. Someone pass the popcorn?
It's not a part of the American culture so much. I think it should be.

I also think speed limits (on highways) should be higher, or be condition-specific. ... and I think we should have better driver's ed in the States, and harsher penalties for drunk driving.

But that's just me.
Overcoming Troubles with Class-Based (Generic) Views
Dumb question perhaps, but what do they need money for? What would they use it for? It says they pay it out to team members, but if people are doing this work for the money, doesn't that defeat the point?
How about hitting up all the multi-million dollar companies that run their businesses on top of OpenSSL?
I think it goes without saying that if you are in a crash at 100 mph, you don't live. If it's a brick-wall type crash, you probably don't live at 50 mph.

I'm not saying that there's any good reason to go 100+ mph. In general, I think it's a terrible idea. I'm saying that it's not as bad in terms of bulk risk-to-life as 40 mph in a residential zone.
Shameful that so many billion dollar corporations rely on it in such a vital way, and only so little is being donated to it.

I think we need a score card for donating to open source projects, in the same way we have score cards for using green materials in devices, or using renewable energy for data centers. We should see periodic reports of how much money these companies donated to open source projects.
What upsets me the most is that they new this existed, and that a lot of the US economy relies on our tech companies, and they did nothing to inform the companies about the security flaw.
I guess I'm going to be the one who has to say this: this sort of "benign corruption" is really gross, and should be stigmatized.
This is a Washington-based reporter, meaning he's most likely more policy-oriented than technology-oriented (got his start chasing stories on the Hill, not in Silicon Valley).

It doesn't excuse a misunderstanding of his subject matter, but an accusation of bias is likely an over-analysis.
I think everyone is missing the real point:

> The CHP 11-99 Foundation has donated over $21 million in emergency assistance to the families of police officers, particularly officers killed in duty

Why do Police officers (and families) need donations to care for them?

Shouldn't their job/benefits do that?
Anyone want to start a pool on when "Free Speech Abuse" becomes a thing in the US?
NASDAQ Falls Below 4000
Because the researchers had the common sense of notifying the biggest targets in advance, I think.
> Now you take the orders of each user and also put them
> into the document belonging to the respective user.

So the database doesn't force anything. The data modeler makes a questionable decision.

> All interesting problem domains just don't fit the idea
> of piece of JSON without references, internally or
> externally.

These databases won't prevent data modeling using references, they just often don't provide as much support as a relational database does for doing joins or enforcing key constraints.
This has gotta be a reporting mistake (both parties say value much lower). The $500m valuation sounds much more reasonable. With a 1x or 2x liquidity preference, maybe it's higher.
By being a major site that uses SSL. Many such users were notified ahead of time; it's nothing abnormal with responsibly disclosed bugs. As far as I'm aware, no money changed hands whatsoever.
TrueCrypt's audit was funded partially through IndieGogo IIRC. So we know it's at least possible.
The NSA has done a lot of beneficial things, such as helping design more secure crypto primitives (e.g. strengthening DES against differential cryptanalysis, fixing SHA-0 to produce SHA-1) and helping build secure software (e.g. SE Linux).

I assume what you really mean is whether their dragnet surveillance in particular is ever beneficial to US citizens, and that certainly seems to be a "no".
No, because people are paying for it. Not directly, but through their internet contracts, banks, etc. Those people expect that their stuff is secured, they do not need to know how.

My grandma probably does not even know that ESP exists in cars. However, if the ESP stops working, then she could rightfully blame the car manufacturer.

Persons are not blaming OpenSSL as some imaginary entity, they blame people who are involved in making, reviewing, accepting and using OpenSSL.
>>That doesn't have to entail turning the world over to Russian and Chinese hackers.

Boogey man FUD, I'm not worried about any hackers from [Insert_forgein_country_elites_want_you_to_hate]. The USgov, NSA and corrupt law enforcement are the only terrorists I'm worried about.
93% of drivers think they're a better than average driver.

http://en.wikipedia.org/wiki/Illusory_superiority#cite_note-...
I didn't know about fuzzers before this whole imbroglio
-- not denoted as such, at least.

If you know `crashme` you already know one fuzzer, which "intended to test the
robustness of Unix and Unix-like operating systems by executing random machine
instructions." See https://en.wikipedia.org/wiki/Fuzz_testing

As a good app-sec'er you seem to need to be deeply steeped in fuzzer lore.
Matasano: "We'll have you write a fuzzer. Everyone here writes fuzzers."
http://www.matasano.com/careers/

(I'm obviously not replying to tptacek,
just highlighting a bit.
... And basking in the good glow, yes.)
Probably lack of incentive to change the laws. Getting anything done in the government is tough and time consuming - Who's going to champion the cause of letting certain people with faster cars be able to drive another 10-20 mph faster versus other issues their constituents may have?
And cheap if no one finds anything.
The Internet Bug Bounty that Facebook and Microsoft are sponsoring applies to OpenSSL: https://hackerone.com/ibb
Of course it's a bubble. Stack that paper now.
You do know that's a common practice in martial arts, right? Instead of face, it's your stomach, generally, but the point is still the same.
It was for a bit more than 50M if you include the earn-out, almost 2x.
PHK predicted Heartbleed? – (FOSDEM 2014 Keynote)
Tech Industry. Nerds.

Does not compute.
Steve Jobs had a neuroendocrine tumor.

These are generally fair better behaved than the more common and far more deadly type of cancer you are probably familiar with, pancreatic ductal adenocarcinoma. While pancreatic ductal adenocarcinomas have a dismal prognosis, most neuroendocrine tumors have a good survivability index.
Another key:

- Communicating clearly and calmly with other people
The code is openly sourced, developed, and tested. It, like privately sourced, developed and tested code contains bugs. Since you are casting the stones, am i to assume code you have been around is free of these eventualities?
What data did you use to estimate the probability of code review? Would be interesting to see if anyone has studied this.
Having enough donations allows someone to work on this full time. People need to eat and pay rent/mortgage.
I'm sure that can be crowdsourced
Don't forget the priors.

As soon as I thought about Heartbleed and the NSA (well before this story), I figured there was about a 99% chance that the NSA had found it and had been actively exploiting it for a decent portion of the time it was in the wild.

Stacked against that, Bloomberg's reliability doesn't really matter at all. If the sources are good, great! If the story is crap, it's still probably right by accident.
Right now there's so much money sloshing around here because (a) there's nowhere else for it to go and (b) everybody's doing it. What happens when there is somewhere else for it to go?
The US government doesn't need to hold cash, because it has the power to print money.
Hey,

I don't really get the app. Can you provide a quick introduction on what it does?
The whole US immigration process is full of craziness. This is pretty well understood. That being said, in my own experience I feel very fortunate compared to many stories I hear. Came in on an L1 visa just over 2yrs ago, my wife was able to work immediately. In SF where we live, having two incomes is very helpful. Almost to the day, 2yrs after arriving processing completed on the green cards which we both now have.

Whole process was paid for by my employer (a large US multinational) that regularly needs to move people around all over the world and is very well organized and takes good care of it's people (and their families) in that regard.

Despite itself, sometimes the process works and companies act well too. In the current system, L1 is generally confided the best case scenario for coming to the US. Any problems you might run into with L1 are still pretty fancy problems compared with challenges faced by so many others trying to get into the country.
Yup.

A guy I know, his dad was paralyzed from the waist down, lives in a care facility and shits in a bag for the rest of his life because someone joker high on whatever didn't want to be arrested.

So folks might appreciate that a cop might be tense during a traffic stop.
Some of the things the candidate might bring up:

- Can they tell me the value and tolerance of the resistor by reading its color code?

- Based on the physical size/package, what's the resistor's power rating? Estimate if you don't know. Does pulsed versus continuous power make a difference?

- What kind of resistor is it? Metal film, carbon film, carbon composition, wirewound, ...?

- What's its temperature coefficient like?

- About what does it cost in small and large quantities?

- What kinds of parameters would you expect to see in a SPICE model?

- What are its noise characteristics? Johnson noise, flicker noise? Say I handed you a metal film resistor -- when would you want to use it instead of a carbon composition resistor?

- What does the resistor look like at RF? If it's a wirewound resistor, or one that was constructed by cutting a spiral groove into a film or substrate, what effect might that have at high frequencies? Estimate what its equivalent AC circuit might look like.

- Any concerns about quality, aging, and reliability?

- How about voltage coefficient of resistance?

The interviewee wouldn't be expected to go into much detail from memory, but they would definitely get extra points by just mentioning some of the factors. It would be fine if they answered the last question by saying something like, "There will be a certain change in resistance with applied voltage. It's going to be small and will almost never matter, but for precision applications I'd want to look it up on the data sheet." Basically I'm looking for an acknowledgement that there's no such thing as a truly linear or "boring" part.

Next question: "Here's a capacitor..."
Was working for CF really that bad?
I speed for my own safety. 90% of the people I see driving just live in their little box, tunnel visioned directly ahead, with no situational awareness of the cars around them. I feel safer speeding ahead and creating as much space as possible than sitting inside of a block of lemmings.
I have been using it for roughly a year now, and I have to say that I am NOT a fan. Admittedly, this opinion is probably colored by my previous history as a user of ruby on rails.

My chief complaints are:

The framework start/stop time is ungodly slow, especially when adding plugins. Many plugins are re-configured at every start, including the prominent Grails Spring Security plugin. Depending on which machine I am using, a shiny new grails app can take nearly 90 seconds to start. This causes me to lose focus, and quickly.

Speaking of plugins, there aren't many to choose from. The key plugins are there, but they are nearly all developed by the core grails team. Most of the third party plugins that I come across haven't been updated for years and were written for versions of grails long past. This means that there is usually only one option available for a certain plugin, so if you don't like the way that Grails Spring Security works or feel that it's too clunky, you're SOL. Best write your own security code.

The resources plugin that is recommended has a very steep learning curve and makes it difficult to include javascript/css frameworks if you don't know exactly what you're doing. Best just not use it and manage your own javascript and css.

Deployment is "easy", meaning that you just tell grails to wad your application into .war format. This also means, however, that re-deploying an application means that you replace 100% of the files every single time. This makes it impossible to push out changes without interrupting user access to your application.

The database management just feels awful to me, although I'm convinced that I must not be doing it right. There is a database migration plugin, but it feels very clunky and I tend not to use it. Rails has very nice database management and it is easy to rollback changes or perform modifications on tables. Doing the same with the grails database migration plugin requires several steps.

The Good Parts:

Like I mentioned before, deployment is super easy. Make a .war file, put it in Tomcat, done. Also, being able to use software like Tomcat is a bonus, because it means a much lower barrier of entry for those who are not as well-versed in configuring web servers.

If you've never installed ruby on rails or groovy and grails before, groovy and grails is by far the easier to configure. Grails is also much friendlier to the windows crowd. However, I feel that these are hardly points to make, as you only really install your framework once (sure there is updating, but ruby/rails has better version management available anyway).

If you've come from a java background, groovy will come very easily.

At any rate, sorry for the novel, but I hope this helps.
Homage to Windows XP wallpaper image
> You can scroll down.

Not if you check it once a day (or even once an hour depending on how many things you follow), it's gone by then.
An Introduction to the Python framework used by NASA, Twilio, and HipChat
A GPL xml library used in commercial product:

http://docs.justia.com/cases/federal/district-courts/califor...
I'll defend the researchers for trying to do a managed notification. But I wonder, did they try to reach out to the major OS vendors to see if they could get them any advance warning? Or ask OpenSSL if OpenSSL knew how to get in touch with people on the down-low?
Well I'll go ahead and agree that for the most part many legal decisions are fairly straightforward. And even their length is usually due to dumping in tons of citations and systematically examining the various components of whatever legal test they're talking about. It's written to convince higher courts and other judges in a way that can withstand their scrutiny.

But as long as you're willing to hit the "I believe" button a few times while reading a legal decision they actually don't take too long to get the gist of.
Acting Lessons (too funny)
It is? It would be shocking if the NSA didn't use Heartbleed. This is basically the equivalent of doing a news story about an alcoholic who drinks the beer they have in their refrigerator. It's exactly what you'd expect them to do.
Totally. If you'd have asked me five months ago which super power was most likely to start the next world war I would've said the US. It seems we overlooked and misjudged a player we thought was fairly harmless though.
You do save time on daily commutes because you're not including the cost of getting stuck behind lines of dumb drivers. You don't always get to go a smooth 70mph. Going faster (even if just by 5pmh) can get you ahead of a car. That one car can make or break you, because they may be the one that forms a blockade across all lanes that inconveniences everyone behind them. If you're smooth about speeding you can use it until you're ahead of the pack, then you hit cruise control.
Thanks for pointing that out. It was a side effect of my killing the comment, so I've just unkilled it.
Google testing a program with advertisers to match clicks to in-store sales
You're committed to my privacy? How about that 1-click client-side encryption button that I've been asking of you for the past 2 years? How about a zero-knowledge policy? Let me know when these are in effect, and then I'll know you're "committed to my privacy", and not just paying lip service to it to gain PR points.
>>If you're not familiar, Scott is a professor of MIT

As I said, I don't doubt his ability. Its the presentation I object to. The HN blog leads to some random blog that barely touches on the topic that the headline promises and the core of the story is in a link contained in the blog. By any sane definition that is blog spam, MIT professor or not.

>>Many readers of his blog are also well known

So? Its linked to his blog, not to his readers. I don't care if his readers include Albert Einstein himself. The link did not deliver despite the authors (proven) ability to deliver on the content.
Both of those would mean that Rice's appointment to Dropbox's board is no big deal, but neither one is compatible with their statement that she "fully supports our commitments".
Not too many stories to cover there. "Breaking News: Weev Still in Jail"
ITYM "target", and not even "biggest", really. They didn't responsibly disclose to any distributions.
You can have a multi-byte chained marker.

Use the first 7 bits of the byte as significant digits, the last bit as a boolean (the next byte is String payload or another byte for string length).
Dropbox on Rice: our commitment to your rights and privacy will continue
How much do you think companies[1][2] would collectively donate in order to try to avoid another Heartbleed?

[1] http://mashable.com/2014/04/09/heartbleed-bug-websites-affec...

[2] https://gist.github.com/dberkholz/10169691
They're illegal in a nearby state however, and a cop can pull you over if they see a detector on your dashboard.

Keep an eye out on state or local laws of course, with any bit of advice.
I gave up on Twitter several months ago. I never really got much out of it. I also quit using G+ after I stopped playing Ingress. Facebook is time-limited to 1 minute per day using the StayFocusd extension in my browser. I've also created email filters that send all social network notifications to the trash.

And that's the folly of most of these social sites. They send you so much data that it eventually becomes a cacophony, and you just want the noise to go away. Instead of searching for notification settings on the respective sites, it's far easier to filter emails (it takes me 5 seconds to create a filter in GMail).

There's a very fine line between meaningful engagement online and annoying nagging. I can see why Facebook is focusing on chat apps, because I think they've discovered that having a social network that is, at its essence, a layer on top of email is a losing prospect. A chat app is a channel outside email that isn't easily dismantled by a filter.
I can easily see a scenario where the overtired guy committed a bug to OpenSSL because he was working on it in his spare time from a paying job.

Many, if not most of us, do the same thing. We get home - we test out ideas, burn off steam, do thing THE RIGHT WAY instead of the way we have to do it at work, etc.

Except for a lot of us, our stuff doesn't go net-wide, or is not important enough, etc.

His did.

I will be making a donation at some point in the future when I can afford it.