skysight-inc/HackerNews huggingface dataset:
Sound of Thunder – Keith Ng on Climate Change
You're not wrong, but this clearly wasn't written overnight in respond to the news. There are almost a thousand commits in this repo.
Ok, I can see the interlocking state machines introducing complexity that is unavoidable but the rest of it just seems like self-inflicted nonsense. I'm more than willing to take a performance hit and have a correct implementation that is easy to reason about in some high level language than one that every other week is shown to be broken because of some dangling pointer in some patch committed 2 years ago. I don't think I'm the only one with this opinion. I'm sure many others would take the performance hit just so they could have the piece of mind that the underlying crytopgraphic library securing their application's data is actually formally verified. The best part about the high level implementation is that it will only get better over time because of improvements in compiler technology.

I'm not much of a conspiracy theorist but this one seems too well placed to be an accident and as long as people can't reason about the mess that is openssl stuff like this is gonna continue to slip in. We have formally verified browser kernels but yet we can't have something as fundamental as SSL/TLS be formally verified. The formally verified browser kernel: http://goto.ucsd.edu/quark/.

Edit: My google foo is very weak these days. Trending story is https://github.com/vincenthz/hs-tls, an implementation of SSL/TLS in Haskell.
How can you judge something with blanket FUD you haven't seen, smelled or tasted yet? Give them a chance before condemning them.
I always ran a homebrew dynamic dns service on my domains from whatever VPS provider I used at the time. Basically create a new A record on your domain (ex: home.example.com), then run one of these scripts periodically on your home machine to keep that A record updated. Here are are the two that are still relevant:

Digital Ocean: http://pushingkarma.com/notebook/dynamic-dns-your-home-pc-us...

Linode: http://pushingkarma.com/notebook/setup-dynamic-dns-using-lin...
Yes, verifying certs out-of-band is most likely more secure than a CA. I was not counting that in the self-signed cert vs CA signed cert comparison, since that is not what most people mean when they talk about a self-signed cert.
The following thread is not directly related, but might be interesting to those who would like to see a constructive response to the quality of OpenSSL.

http://www.reddit.com/r/rust/comments/22gppc/when_life_hands...
Possibly more interesting is a machine checked implementation.

http://www.mitls.org/wsgi
If you are leaking usage information with ocsp/crl checks you are also spewing out information via DNS requests.
Rapidly search all R programming language documentation with Rdocumentation
Neat. A friend of mine evaluated them pre-money and wrote them off initially, but changed their mind considering how far they've grown.
Heartbleed is not exactly a "subtle weakness," it is a gaping hole -- and it is a gaping hole that is only possible in languages with simple pointers and simple pointer arithmetic. In other words, using better languages for the next generation of crypto implementations will prevent this from happening, and then we can all get back to worrying about subtle weaknesses.
There's another name for the phenomenon described by tptacek above: insider trading. Plenty of examples in the wild. The more insiders know what's happening before the markets do, the more likely someone will act on it, or sell the information.
Haskell is a particularly odd choice for a project like this, as lazy evaluation makes it difficult to reason about the runtime of various operations under various conditions.

Something with a bit more ML in its blood would be better, and for a library that pretty much means OCaml.

Edit: I do not at all mean to imply that it is impossible to implement TLS securely in Haskell. Only that there are more natural choices if one wants the advantage of a strong algebraic type system.
Or spoof DNS responses to point to a machine under your control.
Open Government Data: NYU’s GovLab Launches Open Data 500 Study, Website
This is true. Although we do appreciate folks using other Rackspace services along with the free DNS. ;)
If we could throw away CAs, cipher suite flexibility, ASN.1, general baroqueness, C, and the horrible cross-layer pain of SSL, I'd be fine with the hard incompatibility with legacy SSL.
We fixed it earlier today. Interesting wrinkle was that our SSL cert provider's web site was also vulnerable. We had to wait for them to update before reissuing the SSL certs.
The author seems to discuss OpenSSL as if it were the protocol itself, not an implementation of it. OpenSSL != SSL != TLS
If you want to try a version of Star Trek in your browser (ztrek) - http://z-machine.lilawelt.de/game/ztrek/play/
another example I like to think about would be where a large mega corporation makes a bet on a certain technology by buying up a bunch of patents and suing others for infringing, but then as folks in the industry become knowledgeable of these things they work hard to come up with an open alternative and the community begins to pour their efforts into this open alternative (those who truly know the field).

I think it's becoming obvious that this is the direction the technology industry is going. Many other industries will ultimately follow suit but until there is more transparency into the small differences (that currently exist) between how, for example, pharmaceutical companies or oil companies operate, no tangible competition or need to separate themselves from the pack will exist. Once employees truly understand in a more comprehensive way how their employer stands out from the pack in terms of that company's social conscience, they have a new way to gauge their decisions as to who to chose as their employer. I imagine this process (because of many of the ideas presented by others in this thread) would be a slow one, but I get the impression (if dome right) it could have an impact to help force the idea that you will in fact be more successful in the long run if you work hard to differentiate yourself as a socially conscientious employer.
Animals love Soylent too!
Then you're advocating risk management, and not security.
Agreed. I'm a big Ruby fan, but some of the community naming choices are just annoying. In addition to spring: rack, sequel, devise, unicorn, faraday... I could keep going.
We did this by mistake once and got bug reports about PayPal being flakey. (PayPal was an early HSTS adopter.)
The only people you can really give advance notice to are those who will keep it secret until the embargo is lifted. That is basically attackers (TAO), service providers (like Cloudflare and Akamai), and very small software development teams who don't release code to public repositories.

I'm sure glad they gave CF advance notice vs TAO (presumably). I'd prefer if it just dropped with zero notice for anyone, although if a security company wants to provide priority notice about vulnerabilities it discovers to people who pay the company in advance, good for them.
The gloves that will "change the way we make music"
Many people eat mediocre or plain food, particularly for lunch. If you could substitute something that was healthier and more convenient you're not exactly forgoing "sex" if you are replacing a turkey sandwich, fast food, etc.
I generally agree that rewrites are a bad idea. However:

1. Competition is good. Business, open source... doesn't matter; some competition almost always leads to improvements.

2. Sometimes a rewrite can be justified when there's a real difference of design behind it. For instance, using a different language with greater safety (type safety and/or memory safety) might be the only way to get this to the level of security we expect.
I would love to know the price tags, ballpark informed guesstimates, for the following:

* Audit of openssl
* Audit of openssl + remediation work
* Brand new implementation of ssl library (100% feature parity not required)
We ship orders based on size first and order date second. If you order a week today, that order will be placed at the back of the queue. If you order say 6 months, your order will be one of the first to go out.
Parking.
We had the same issue with KDE, pretty sure Qt did too.
I'll be the first to admit that both of those applications are the source of much misery if mishandled. JIRA especially, considering how many layers deep you can go sometimes. This issue type belongs to this scheme which uses this screen in some issue types but not others, that's designed in another scheme... aiya. It gets complicated.

Unfortunately, that's enterprise for you. Basic human logic is often insufficient to handle the demands...

Those applications are absolutely only as good as the time taken to adapt them to the needs at hand and to the team using it.

And +1 for markdown support. There are plugins out there that add that, but... don't get me started on their plugin ecosystem.
rewriting is almost always a mistake

I'd make an exception for rewriting in a language that prioritizes safety towards the top...

http://www.reddit.com/r/rust/comments/22gppc/when_life_hands...
Could you elaborate on how lazy evaluation is problematic for such a project?
Ask whoever wrote your client software to rebuild it with a new version of OpenSSL. Or, if its open source, try relink it yourself.

I guess through some convoluted MITM attack, somebody could (for example) try and exploit your email client, or similar.
This page lists some: http://wiki.dlang.org/Current_D_Use

Work is happening with ARM, but it needs more pre-early adopters. http://wiki.dlang.org/GDC/Cross_Compiler
They also taste terrible and are not "designed" towards the end of regular meal replacement for healthy people.

Not saying soylent 1.0 is much different but the fundamental difference in market and purpose will drive soylent farther and farther apart from ensure et al.
I put on 20lbs in 2 months. Having Soylent made it so easy to measure exactly how many calories I'm getting and how much protein and fat to add on top of the base formula (2k cals per 66oz). Others in the company went the paleo diet route and spent 5-7x more money and 10-12x more time on prep.
So the million odd revocations of class 1/2 DV certificates that have been going on the last couple days, are basically going no-where, right?

I mean, by all means, rotate your key and get a new cert, but my guess is CRLs cannot handle making space for a majority of SSL'd domains in the list.

I don't want my browser hanging up a secure page load while it downloads that file... More to the point, I don't want a million dot com revocations getting in the way of my browser learning about that "Major Root CA" that was compromised last week.
Why do you use an archive.org link to my server, btw? (I don't care, just curious; I've been meaning to reprocess the archives and make them directly searchable once I find better tools)
If you logged in (as in, typed your username and password) in to the site during the time the exploit has been disclosed and the site has been vulnerable, I would change your password.

Otherwise, insist that the site owners invalidate all existing sessions.
Personally I love my Northgate Omnikey, some love their inherited IBM keyboards. Whatever.

Since you bring up Docker, it's the ease of use and sharability that are the big wins outside of how it's implemented. Heck, if you want to get real, it's a wrapper around lxc. Folks I know that are serious Windows hackers with zillions in funding decide not to compete with Docker because it wouldn't be differentiated or better enough to bother... They're on track for acquisition and it wouldn't have been worth lost momentum.

People need new things to love as they fall out of love with the last that didn't fulfill an inner existential emptiness. (Chronic retail addiction.)

Also people love to tear down the works of other people, because either they didn't think of it, they wish to justify their own laziness or are afraid of being abandoned.
Sure, the advice is still as sound as it ever was.

So was the advice about going to war with the Army you had, not the one you'd wished you had.
Promote advanced personal development and cancer treatment approaches based on helping people to eliminate fear from their body/mind systems.
Soylent has all of the RDI's of vitamins and minerals for your diet. We don't expect anyone to live off of it, but we design it so you can feel confident that Soylent is an option to do so if you absolutely have to.
Exactly; well said. It's been about a year but basically I had a replica set where sometimes one replica or the other would segfault and I'd have to manually delete its data files and re-replicate, after which it was fine. Happened about every few months. It was clearly based on application behavior and not an inherent system problem such as those you listed.
Facebook privacy settings are about to change again
I agree, almost nobody writes: "I've been warned, but I pursued my dream anyway, and then I failed miserably." I did.
Lazy evaluation is the default in Haskell, but that doesn't mean strict evaluation is unavailable.

Here's an example of a type definition that specifies strict evaluation https://github.com/vincenthz/hs-tls/blob/master/core/Network...

See? They don't have to switch languages after all.
Have you ever thought of renaming D?

Or releasing D++ !

(Amazing job with it all BTW)
You knew what I meant. They are putatively under different hierarchies.
Apple's Steve Jobs Admitted Android Envy
Article raises a good point.

Seeing this repeated 50+ times made me cringe though

if ((req = X509_REQ_new()) == NULL)
ERROR_OUT(ERR_SSL, done);

seriously..

also, writing new code and not using Rust, or D, or even C++. WTFs like the above are par for the course when you're writing in a 40 year old language without any features of modern low-level languages.
ARM or possibly Atom in a box, so pretty decent performance. The pain of the HSM is the physical packaging, and my ultimate goal is to make that reusable and let users select their own components and do their own final assembly and certification.
> so few people eat a consistent diet of chemical-free, healthy whole foods. Just drinking Soylent to avoid the chemicals in our current food supply

Everything is made from chemicals. Which ones are you referring to?
Route 53 seems like a way to go with their GeoDNS ability and bunch of cool other features. To bad Dyn.com goes all paid though...
Nope. This is a common troll whenever any Haskell project is mentioned. It's despicable FUD and just plain wrong. Haskell makes it very easy and lightweight to add strictness annotations to your data structures; far, far easier than it is to add laziness to a strict-by-default language.
TAO = NSA Tailored Access Operations

https://en.wikipedia.org/wiki/Tailored_Access_Operations
If you're graduating established companies will generally want to get you down as a fulltime employee. But you can always get an intership with a startup. Learn how to talk up your contracting work. Try to make it sound cool or interesting.

I'm sure you could get an entry level coding position at any number of companies coding is in super high demand. Don't expect to get microsoft, apple, or FB unless you're either ungodly with algorithms or have a bunch of interships during college.

You should expect to be challenge and engaged in the work, get good benefits and a decent pay (60k minimum).
Why don't you test the library before making assumptions about it's runtime characteristics. How about doing the slightest bit of research on the creator?
Not him, but I don't think the regular lazy evaluation worry about building up a million thunks and GC hell would be as much of a problem as it being awkward to not have things happen too fast and leave side channel attacks from timing.
GTA ONLINE: Epic 5 Star Police Chase and Getaway
I certainly believe that you're correct to question the utility of revocation.

We don't have all CRLs for all CAs (sadly). Some CAs have also asked for the list not to be published so there's no list of the URLs that we do crawl either :(
Cafe theft suspect nabbed after video goes viral
In cryptography, for most operations, you need to be sure that the operation takes the same amount of time for all possible inputs. Otherwise, you leak information.

The classic example of this is checking string equality with strncmp(): this takes a different amount of time depending on how similar the strings are. If one string is secret and the other is controlled by an attacker, the attacker can use a clock and multiple attempts to discover the secret.

Obviously this particular one isn't relevant to SSL, but there are a number of other possibilities to worry about in most languages, most obviously short-circuiting operations like boolean AND/OR. Lazy evaluation makes every operation short-circuit, so you need to worry about this in every operation.

It can be done, but it's harder than it needs to be.
Wikipedia 'edit-a-thon' seeks to boost number of women editors
Font War: Inside the Design World's $20M Divorce
Nice and everything, but I somehow cannot imagine people massively jump over it. Maybe it's superstitious, I dunno…

On the other hand, I undoubtedly agree that we should start making and deploying alternatives in more safe modern languages. In fact, I guess we should start step-by-step rewriting everything that's written in C/C++ and OpenSSL is a good thing to start with.

I guess it's a good chance for Rust & friends.
I solved it by basing the robot's movements off my own using my position. Hopefully that's vague enough to be a decent hint but not a giveaway...
The real problem is routers have hardwired dyndns settings; in many cases with no other options.
You are so right about the memories. We played a version of this on a teletype. A game would take a box of paper in the library. lol
I'm in the Bay Area and would love to work remotely on hardware/firmware. Let me know if you'd like to give it a try - email in my profile.

I have all the usual stuff you'd need to develop / debug hardware and would be open to fly on-site every now and then too.
Cool company. The story doesn't mention it but the company does all the UAV flights to collect this data for the farmer in order to perform the analysis.
What a bullet point to put on a resume. Congratulations Mr. Mehta.
Were the divide by twos just bit shift operations? (I have no idea if the 6510 had bit shift operators.)
> The trope is universal and deeply embedded in American society.

No, it's not. Quit trying to pass yourself off as the ambassador of American culture. The majority of my 50 years on this earth have been spent living in the Midwest or U. S. South, neither of which are exactly hotbeds of racial tolerance and likely the origin of any racial slur you'll hear. And yet when I saw the title it never occurred to me to think of race at all. That is, until your comment showed up and I said to myself, "what the hell is he talking about?"

Sure, there are some racial slurs that involve the word "monkey". But they're not even close to what you're talking about, and if one were to use them one would come off sounding about 76 years old.
Improving the fast inverse square root
I did it by drawing on the canvas to mark the way. (I'm trying not to spoil it, apologies if this is too vague).
Has distro notification caused problems in the past? E.g. patches posted early, emails forwarded, public discussion, etc.?
Well, the truth is somewhere between the two of you. The academic consensus (at least among economists) says that there is a gender pay gap that they cannot account for other than because of discrimination, but that it is in the single-digits, contrary to activists' claims.
This particular breach is very bad.

That said, for a piece of software as widely used as this, what is the actual count of vulnerabilities found?

I've spent quite a bit of time in the openssl code base for various projects over the years. I find it generally readable, but then I've seen some pretty odd ball C code over the years.
Who the hell went through the trouble of buying a domain name, building a website, and designing a logo just to talk about one bug?
> few people eat a consistent diet of chemical-free, healthy whole foods

"chemical-free, healthy whole foods" is a nonsense phrase. Particularly "chemical-free foods". Not only is everything made of chemicals, but the whole point of foods is their behavior as reactants in chemical reactions.
Ask HN: Why haven't we automated government?
I tend to get some really wild ideas sometimes, so bear with me - but I think this is something worth thinking about. Governments (at least the democratic kind) have always been about representing the ideals of the majority of the population. This has often come in the form of elected officers representing constituencies with their platform of beliefs. It's my understanding that this infrastructure was set up this way because it was an individual's best way of having their voice heard at the time. We've obviously come a long way since the invention of democracy... And we've seen how technology (especially the internet) can empower individuals.

So what this has been leading up to is: does it not make more sense to put power back into the hands of the people, and allow everyone to vote on specific topics rather than focusing on what party to vote for?

Edit: I suppose this is more of a question of elections - but perhaps we could dive a little deeper and imagine that there are government works who act solely on the outcome of regular votes.
I would not call the space incredibly crowded. In fact, I'm not aware of anyone else promoting at the consumer level a 14-21/week meal replacement product.
The Forgotten Childhood: Why Early Memories Fade
You don't need a committee to build rock solid software. There are all sorts of formal verification and modeling tools for specifying machine checkable specifications. The overhead in many cases is high so you're not gonna use it when writing a web 2.0 application but not when you're writing software that is a fundamental part of internet infrastructure then the bar needs to be higher. 1000 eyes making all bugs shallow is not the right approach in such cases.
Crypto poses a unique challenge with the threat of timing attacks. A major benitif of using low level languages is that it is easier to assure that your code takes constant time regardless of the input.
This is an excellent point, and I didn't mean to imply that it's impossible to implement TLS securely in Haskell (though my original comment did seem to; I plan to fix that shortly). Only that there are more natural choices that give the same primary advantage (a strong algebraic type system).
> No I'm saying that sms arabic is a transliteration or arabic into latin script...

I see your point. Though that still does not advance Luxemberg's claim.

> In modern arabic, sort-of (spoken, yes, written, not really, same as in hebrew really, which is to say, not at all...

I really don't understand this claim. What about the following letters since you say you can read Arabic: (و، ا، ي) Aren't they vowels? Did you take a look at the Kufic manuscript I linked in my previous post? Those letters exist there as well. Hebrew and Aramaic both have corresponding letters to those too.

> Obviously the arabs living in the 8th century still used vowels, just not in writing...

The Kufic script image I linked to proves otherwise.

I take it I got the point across with the root of the word Qur'aan (Qa-Ra-'a) :-)

> It's "unique", is that perhaps a polite way of saying that it's very different from anything else you've ever read, with "weird" verb forms, words with wrong roots and the like ?

Speculation on your part (when you say "perhaps"). I will try to go more into details about this topic in another post (if this thread remains open!)
https://github.com/vincenthz/hs-tls