skysight-inc/HackerNews huggingface dataset:
As with any study of this nature, there is a good chance that the observed effects won't apply to humans, but it's interesting nonetheless.

The researchers point out that there's been a couple observational studies (not RCTs!) that have found decreased mortality in humans that supplement glucosamine:

http://www.ncbi.nlm.nih.gov/pmc/articles/PMC3557824/

http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2869514/

What I'd really like to see, now, is a randomized controlled trial that looks at mortality in healthy, non-arthritic people who supplement glucosamine - alone, without chondroitin or other stuff.
Ask HN: Which web framework for MVP?
I want to build MVP asap. So what do you advice? I am considering RoR, Django and Play. But also be able to switch in case I have to do it in the next step. Thanks.
Start a own business with $100
Furthermore, you aren't bounded to any domain. So Startcom gives unlimited SSL/SMIME/Code signing certificates for almost a year after paying $60. Non-wildcard certificates are free (altough your name isn't on the cert).
I find it's the most reasonably priced CA of them all.
http://www.nerdist.com/2014/02/dice-whats-happening-with-the...
I havent seen a point by point comparison. Feature set, and even the API, are basically identical for now.
Sounds a bit like Sun's Metro WS-Security implementation
Is SQLLite fixed for Windows 7 or Windows 8 x64? This was the reason why i uninstalled Rails 4...
It's not unreasonable to charge a little bit for a revocation. They require more work than a cert itself (updating and hosting the revokes list etc.) and a fee prevents unneccesary revokations from taking place.
Was thinking the other day, VR is the perfect use-case for those outrageously high-ppi displays Sharp and Samsung have been showing off recently.
There's a lot of rebalancing going on ATM, I think they're doing rather well.
It's hard to define semantics. Here, you have potentially copied less than dst->len bytes into dst->data. Is the remaining data (up to dst->len) still valid, is it garbage, should you have adjusted dst->len, etc?

When does it even make sense to partially mix byte-level representations of some data?

The buffer abstraction is necessary, but far from sufficient to build security-critical code. To do so, you also need to code in semantics somewhere, and buffers know zilch about the meaning of the data.
I'm digging into "Is Parallel Programming Hard, And, If So, What Can You Do About It?" https://www.kernel.org/pub/linux/kernel/people/paulmck/perfb... and liking it!
With startcom you cannot request a cert for the same (sub)domain until the current certificate expires in 2 weeks or less
Moore's law is only about transistor density, the clock speed race of the 90's mirrored Moore's law but was only indirectly related (in that the smaller you make a circuit the less time a signal needs to propagate through it).

The improvement in GPUs is all in line with Moore's law.

>On top of that, there's been failure to move to distributed and multicore processing outside of GPUs

Few ordinary tasks besides graphics processing benefit significant from multi-threading, and the resulting program complexity means developers don't bother with it for minor improvements.

There are other benefits from the power of modern processors, such as running programs in sandboxes to improve security, and being able to run multiple CPU intense programs on separate cores.

> but when the single fastest increase in my computing in a decade came from installing a 512 GB SSD drive, it means that something went terribly wrong.

No it doesn't, it is just that SSDs cut disk access speeds more in absolute terms than going from 1Ghz to 4Ghz improves program speed. A modern 4Ghz CPU is more than 4 times faster than a 1Ghz early 2000's CPU, but in absolute terms the speed up is small (ie 500 ms to 50 ms is more noticeable than 50 ms to 5 ms).

Try running a CPU bound task (the ordinary user doesn't have these) on a early 2000's CPU compared to a modern CPU.
Read the link, agreed it is a great idea.

The problems are not technical, but that of trust. How do you get a reliable mechanism for trust that resists social engineering?

Maybe the Hacker News community could be a starting point? Some combination of karma, longevity, vouching via LinkedIn, etc? Problem is that almost everything that I think of can be gamed. Maybe some other readers have a more comprehensive grasp of how to go about making such a CA solid and reliable.
I wonder if OpenSSL will get some code clean up courtesy of the extra eyes that are now on the code?
DVDFab Blu-ray Creator works as a powerful Blu-ray burning software
DVDFab Blu-ray Creator, a newly designed Blu-ray creating program, converts all the video files on PC to BD-Video format with strict Blu-ray file structures. The output can be Blu-ray movie folders saved on PC for viewing via media player software's or real Blu-ray discs that can be played on Standalone Blu-ray players. You can learn more about this site at: http://dvdfab.cn/blu-ray-creator.htm?ad=hcj
But you CAN revoke the current one.
There is a TLS implementation in OCaml in progress, it still has a long way to go though:
https://github.com/mirleft/ocaml-tls
Know who to call and when to call. Try it free.
Yes.

You haven't lost it.
well, not with their webui.
MAGIC_NUMBER?
I want people to use real certs for START TLS email, client certs, etc.

Because StartSSL issues them for free, I actually did exactly that -- used a separate certificate for each of my secure services (IMAP, SMTP, HTTPS, etc.), on each of my domains. I believe I currently have roughly 25-30 certificates issued by them. My thinking was that, despite the extra configuration complexity, if a particular key were compromised, at least I wouldn't have to replace all my certificates!

Ugh.

So now, ironically, I'm faced with having to replace all my certificates, not to mention paying StartSSL $25 per certificate if I want to do the right thing again and have all the existing ones revoked, as well.

Instead, I'm tempted to "pay up" for a wildcard certificate for each of my domains from a provider whose revenue stream comes from minting certs, not revoking them. Configuring my services sure would be easier with 5 certificates rather than 25. Also, I've never leaked a key by any error of my own, and I'm beginning to think that's less likely than someone finding another hole in OpenSSL (or a CA) which requires wholesale certificate replacement again.
Thanks; fascinating. The "length" of the payload is useful for error correcting, but the implementer didn't take advantage of this property, so it was usable against them. A double edged sword.
Do Turing machines have a concept of "undefined behavior" in the same way that C does? AFAICT all behavior of a Turing machine is defined -- sure you might not calculate what you want, but that doesn't admit arbitrary behvaior outside of the semantics of the machine as in the C language.
I just copied the links from wikipedia :)
First, I went through that story myself. You're going to be fine, in all likelihood. I've actually done this twice now—the first time because of grades; the second time, my grades were fine (close to perfect, actually) and I was just taking a break for a semester that stretched out years, and I realized at some point that I'd have been kind of nuts to go back.

You should be aware of the challenges you're going to face though. Not because of your grades or schooling, most likely (though that will close a few doors) but because you're still fairly inexperienced, and it can be hard to land those first few gigs. Develop at least one or two deep skills. That will get your foot in the door a little easier. Blog a lot. And the last, best piece of advice I have, that I wish I'd learned ten years earlier—build your community network and find a mentor. Those relationships are the most critical assets you can have early on, IMHO.

There's a hundred ways to success, and those are just the things I've learned so far—about me. There's sure to be a lot of other good thoughts about your situation that are worth paying attention to, and you'll still likely find your own. Best of luck to you.
I had a rather critical view of D at first. Another C like again, we never get rid of these bracket-oriented languages! Then came Go and Rust, and my opinion has changed, I see it more favorably, as it does not seem to be the worst of them.
if(obj != null) {
obj.stuff = ...
}

I mean how hard is that exactly?
yet Java applications have null pointer exceptions all time
Show hn: Mavericks homescreen
After living in France for most of my life, I can confirm this is true: underinvestment remains the main choke-point though. Homeless shelters can be violent and unsanitary places; before making them psychiatrically sound, you need to increase their ability to separate visitors.

I am not in Scandinavia, were homelessness can not be a year-long issue (-30°C day round). There are far less beggars even in Summer because the State is not just more generous, but seemingly a lot less focused on red-tape. Most cases of denying help that I’ve heard (from charity work and working at a teacher in jail) were related to not ticking the right boxes, something for which mental health is a big handicap, but being sane isn’t remotely enough.

For instance, what appears to be the main trigger for homelessness is a couple separation: the less motivated employee, gets fired and can’t pay for his temporary accommodation anymore. That is a classic case where leniency in proving you can’t live in the house in which you are registered helps.
Pakistan charges a 9-month-old baby – attempted murder charges
HN front page is heartbleeding, I counted at least 8 stories.
The legal complaint by Frere-Jones is riveting:

https://iapps.courts.state.ny.us/fbem/DocumentDisplayServlet...
Anyway, apparently the executives of https://en.wikipedia.org/wiki/Shandong_Steel don't have a problem buying private jets and flying to Phnom Penh in Cambodia for private parties... I saw one on the tarmac yesterday.
Stanford Eclipses Harvard as Applicants Eye Innovation Focus
Well, that is with good reason. A rogue or insecure root CA which is trusted by major browsers/OS'ses would basically invalidate the whole CA system (see the DigiNotar affair from 2011).
Why does it have to be free? 5 bucks a year for an SSL cert is peanuts.

If you want free, push for killing CAs :)
While it could be a win-win situation I feel like the underpaid/job stealing argument will be even more heated by a service like this.

Also the fact that "transferring" a H-1B takes longer than the grace period you have when laid off/fired (1 month?). Unfortunately the "panic button" that I know some people use is to convert to a full time student and try again later.
Yeah, I'm not really mad. Every time I have interacted with StartCom personnel they've been fast, courteous and competent, and their style is enjoyably direct and goal-focused (plain email, no boiler plate, no patronizing). I like the idea of competent people getting paid well, so that soothes my hurting wallet a bit.
Are We “Abusing the Buddha? | live with yoga
i thought there's built in sync to ftp,webdav.. http://keepass.info/help/v2/sync.html , http://keepass.info/plugins.html#ioprotocolext adds sftp/ftps..

and an android app https://play.google.com/store/apps/details?id=com.android.ke...
I was doing OK with this rant and was following it until the burning man people are all libertarians section. No they are not. The whole piece smacks of the same dumbass world versus tech bullshit I see around. Super tired of it at this stage. Probably all typed on a Mac Book Air in a coffee shop somewhere. Fuck off.
> its written in F#, so you have to trust your CLI implementation to be bug-free as well

Is that any different to an implementation in C relying on the processor being bug-free?
Probably just to make it easier to understand what's going on. If they just had "20+..." it wouldn't give you any hints where the 20 came from.
>Homelessness is also quite often a problem of mental health

Provided that you've already set up a system to help the people who merely need economic assistance. Germany vs America right now are two very different situations, precisely because Germany provides more economic assistance for the mentally sound.
Am I the only one who thinks the `Module.concerning` thing is silly?

Concerns never did anything for reducing real complexity in the first place, except improve code geography, and now we don't even have to bother with that. Yay.
Is the latency that bad? Because you wouldn't want to go below the Oculus there; the Oculus is great because of it's low latency. More latency will just make people vomit and definitely not sell units.
Define "better". Probably it wouldn't be more secure because both would be scrutinized and production-tested about the same. It would protect us against some common C errors but might make us vulnerable to "common" Haskell vulnerabilities. You really can't say.

It probably would be slower though, which is kind of a big deal for webservers and the like.
Bricksmith 3.0 released: Oh so Flexible
RoR. Lots of online docs and support, lots of gems and you focus on your task at hand.
OS X 10.9.2 still ships with OpenSSL. Luckily it's 0.9.8 and immune to the heartbeat bug.
Otter Browser (Opera 12.x FOSS clone project)
>of course the caveat that those places have far more affordable housing and far more units to actually give away was not at all mentioned even though ~22 paragraphs previously the author was talking about how expensive 1 bedroom apartments are in SF and other tech hubs.

Then I would imagine that this is an issue where we can help both the homeless and tech-workers alike by building a bunch more housing.
No. Neel found it by auditing code. See CVE-2011-0014 for a previous OpenSSL bug he found by auditing code. See CVE-2010-0239 to witness his awesome ability to find bugs by auditing assembly code.
You can't use wildcard for EV domains.
I personally use the silver searcher[0], also known as ag, which is .gitignore aware and I find quite quick and useful.

In fact, ag references git-grep in its readme while this blogpost makes no mention of ag. I suspect the author just doesn't know about ag or doesn't want to install an additional less-standard package... I personally find it worth the installation.

[0]: https://github.com/ggreer/the_silver_searcher
> A rogue or insecure root CA which is trusted by major browsers/OS'ses would basically invalidate the whole CA system

The CNNIC root is still trusted by most browsers/OSes.
Access to the source code is one thing, but you'd need also developers who are familiar enough with the source to be able to actually make changes. With OSS, there is a large community from which you recruit these folks, with Windows, not so much (outside of MS).
Are you familiar with any of the base languages of these frameworks? I would suggest the language you are most comfortable with.

If you are new to all of them, then build something very simple with each to compare.
Image From Curiosity Rover Reveals Mysterious Light
Not done. Would it surprise you to learn that "all this rewrite talk"--which was merely one question--was simple curiosity? I did not realize that asking a question would be such a problem for you. I have seen different suggestions of crowdfunding an audit/rewrite and I have have no concept of the price tag for such complex projects.
I was curious about SIMD support in JavaScript and it looks Firefox nightly already has an API for it and Chrome too is getting it.

http://www.2ality.com/2013/12/simd-js.html

https://01.org/blogs/tlcounts/2014/bringing-simd-javascript
> If what's needed is speed, neither Java nor C# are optimal choices

"Speed" is relative. If you mean throughput or scalability (2 different things), then the JVM or the CLR may be exactly what you want due to the ease with which one can juggle with multi-threading on multi-core processors.

Single-threaded performance is becoming less and less interesting and dealing with multithreading or with asynchronous I/O in lower-level languages, such as C/C++, is an extreme pain in the ass - because for example, C/C++ doesn't come with a memory model by itself (i.e. you can get fucked even when running with a different Glibc version) and the poster child for async I/O, libevent, has been plagued for years with concurrency issues, leading to a whole generation of insecure web servers.

The JVM, .NET and managed runtimes in general are great choices for going forward, because not only they come with memory model guarantees and a sane standard library - but having higher-level bytecode under the hood that can be generated at runtime means that either the runtime or the libraries running on top can repurpose that bytecode at runtime for optimal execution. Like for example, you could target the GPU when dealing with parallel collections.
That makes sense, since database.yml is not going to contain any sensitive data anymore (passwords and usernames will be stored in secrets.yml), this file can be safely stored in repository.
Footage pages – Stock Footage
They've been tweeting saying they aren't revoking them for free.
Agreed. So absurdly great. But also, it's oddly (to me anyway) polarizing. Which has its benefits: it's a real quick and easy way to figure out who in tech is insufferable: they don't find it funny? Then they probably are the targets, and could probably use a sense of humour.
I don't see any source code for this.
My Response to "Why Nerds Are Unpopular" by Paul Graham
Here's the link to my blog post:
http://blog.myadversity.com/2014/04/my-personal-response-and-continuation.html

The link to the essay by Paul Graham is at:
http://www.paulgraham.com/nerds.html

It's a lot to read, so here's the tl;dr version of my blog post:
In his essay, "Why Nerds Are Unpopular," Paul Graham explains that the hierarchy of popularity in high school works well for jocks, but not for nerds. Nerds choose to be intelligent rather than popular. He offers some relief to young nerds by informing them that, in the real life hierarchy of success, nerds have the advantage and jocks don't.

In my response, I argue that a nerd who deviates from the status quo still meets relentless opposition to real world success; perhaps even more so than a nerdy jock who deviates from the status quo path to popularity.
+1 Ledger. Works well with cryptocurrencies and fits into my command-line centric workflow well.
Beta Testing Optimization Toolbox: ILNumerics
Thankfully, I don't need those!
Latency in general is bad. This is why theres a big rush to get DisplayPort 1.3 variable framerate monitors onto the market (should be out late 2014, early 2015)
I'd rather say that the long list of overflow-related vulnerabilities would be a good argument to ensure that all crypto libraries are implemented in some kind of a strict language that disallows a large class of vulnerabilities, even if it costs us some time and effort.

Seriously, for many languages bugs cause unintended behavior within bounds of implemented logic - such as the recent logic bug that returned an 'okay' response even if the certificate was invalid; however, the fact that ordinary bugs tend to have effects of "read arbitrary memory" or "execute arbitrary code" is a very specific niche of C and friends.

In a language appropriate for security, a bug in heartbeat extension would break the heartbeat extension - maybe disable heartbeats not work, maybe cause different heartbeats - but it should be unable to affect the rest of application. In a language appropriate for security, if a single module is secure (i.e., the limited number of API/method calls it exposes are secure), then bugs in all other modules shouldn't be able to affect the insides of that module; so if your app has a tiny core that does some signing w/o exposing the key secrets, then the rest of the app can't touch it even deliberately, much less by an acidental bug.
Getting an idea of the effort/resources that have gone into openssl is a large part of why I asked the question.
To the point of doing business under the purported employee's name! That's pretty low.
It's the biggest security vulnerability in the modern crypto age. Sysadmins everywhere are scrambling to renew keys and certs. It warrants at least 8 stories on the frontpage.
Sociopath?
Bitcoin Transaction Malleability and Mt. Gox (based on Bitcoin network data)
Russia offers to develop supercomputer with India to counter Chinese supremacy
How would you restrict the possability of lifting a function into an Applicative? Can't you simply use pure and <*> for that?
Silicon Studio New Rendering Engine
Thanks everyone who answered. There are a lot of questions but most can be distilled down to how lazy I was.

I was lazy this semester, I thought I had a good handle on the material until this week when I failed all my midterms. I hardly sleep anymore which also plays a roll. I for sure could have been more active in pursuing help but to be honest I had no idea I needed it

I go out a decent amount, usually once a week, sometimes twice. It's not the "weeeeew college" level of partying from freshmen year, I would say it has little to no impact anymore on my grades.

One last relevant fact, it took me 3 tries to pass calculus, in highschool I was passed in precalc because the teacher knew I was involved in a lot of work after a botched computer donation program to our neighboring schools. This year I had to self-teach myself a lot which was tough, and the few times I did see my professor or TA they would only explain the material covered in class. To quote "I'm not here to teach you algebra/calculus". That is totally reasonable but having to have a logarithm cheat sheet with you at review sessions kinda sucks, not to mention I got shot down enough times early on where I would second guess asking questions for fear of them being too elementary.

I'm aware I fucked this up, but I really do love to code. It's the only thing i'm (ironically) not burned out on.
i dont get why its considered hard to install an apk.. u download it and run it..and android will say u need to tick some box to install this and u do.. and then it installs.. people download and install windows software all the time, it works almost the same...
Couldn't you expose machine-dependent stuff in a subclass?

SSE has a bunch of other useful instructions like PMOVMSKB (useful for fetching the result of vectorized comparisons, yay!), then there are string instructions (sometimes also useful outside of string processing), etc.

New versions (AVX-512) will also have mask registers for masked operations.
Chrome and Firefox work just fine in Windows XP.
I'm sort of surprised an allocation occurs every time the heartbeat is sent. That is a lot of trips to the heap.

I'm not very familiar with how TLS heartbeats are implemented, but I wonder if the buffer could have just been alloc'd once when the connection was created.
jd.com is huge in China.
> With the Manufacturer & Model info from the tag you could make an educated guess about professional vs. non-professional photography and draw conclusions about website's intent.

That is really bad IMO. I don't want my images judged on which camera I used. I want them judged on their content. I don't decide which book to read based on what program was used to edit the book. I don't watch a movie based on what software was used to edit it. Why would I judge a picture based on what camera was used?

If sites start judging content by camera then there will be an incentive to edit the EXIF info to make it appear the best camera was used.
Strict fields are actually standard Haskell, http://www.haskell.org/onlinereport/haskell2010/haskellch4.h...

(The similarly looking BangPatterns extension is supported by GHC only.)
Good Ambition Bad Ambition
Man, people should write ore books on Flask framework. :(
To be fair, the words "change the world" are almost never next to "for the better".
Original HN post: https://news.ycombinator.com/item?id=6533997
Can you elaborate what those features are?
Google I/O 2014 Registration Moved April 15th – April 18th 2014 • vlogg.com