skysight-inc/HackerNews huggingface dataset:
Joe D'Aleo, the first director of meteorology at the Weather Channel who now works with WeatherBELL, is explaining to anyone who will listen that NOAA did exactly that.

http://icecap.us/images/uploads/NOAAroleinclimategate.pdf

Closing line:

"The NOAA, NASA and the Hadley Center press releases should be ignored. The reason which is expanded on with case studies in the full report is that the surface based data sets have become seriously flawed and can no longer be trusted for climate trend or model forecast assessment in decision making by congress or the EPA."
> you can't use it to connect arbitrary ports of those unit generators together. Each has only one designated ChucK input and/or output. This makes it difficult to truly experiment with modulation

You can route things to multiple destinations with multiple ChucK operators.

You can also route to specific inputs by naming them.

Arbitrary routings are neither impossible nor a problem.

SinOsc A => dac.left; // Here, A's main output connects to a specific input of object dac.

SinOsc B => dac;

A => B.freq; // Here we see the same A having another output connection, and connecting to a specific input of another object to create FM modulation.
So? Even if the key is in the hands of an attacker, what can they do to the corresponding entry in a revocation list? Add it, nothing else!

Unless, you mean that the owner has lost access to the private key itself. For that case, I can see CA's having the power to revoke certs in addition to my suggested method.
"After all, it’s not like you can choose whether to be a female CEO vs male CEO. But you can choose your attitude toward it."

exactly , gender shouldn't be a deciding factor , well written
>> Why is the power of revocations in cert issuer's hands? As long as the private key is private

>Because a major reason for revocation is when the private key has been compromised.

His point is that whoever compromised the key is not interested to put it in the revocation list. If he does it... well, he did the good thing.
Joy. That'll be why we got a massive error spike this morning then.
Hapi.js to everyone http://spumko.github.io/
Phabricator and NuoDB: Porting a PHP application to a distributed database.
Despite heartbleed: Certification revocation refused
Without recompiling or hunting for old libs?

I know there were a couple of pretty significant glibc upgrades, and IIRC the binary format changed at some point from something earlier to ELF. Hrm. "something earlier" seems to have been the a.out format, based on Eric Youngdale's 1995 Linux Journal article:

The ELF Object File Format: Introduction

http://www.linuxjournal.com/article/1059
IETF groups continue to perpetuate this junk, too. It opens up security holes, as you can end up with a "confused deputy" situation. A proxy might read certain header fields one way because the spec encourages the proxy to "infer" the "meaning" of creative headers. But a server behind the proxy might interpret things differently.
Did anyone have any experience with this? How mature/stable the project is? Can you expect to successfully port a 10KLoC Objective-C application to it?
I never understood why people use StartSSL. Their service is horrible. The interface is far beyond ugly. You could get a SSL certificate in a nice and easy way for 4,99$ at http://www.ssls.com/. (They reselling from different CAs. They cheapest one is currently PositiveSSL)
Didn't have any spare time to have a go at this, here's how I was going to do it:-

1) Create a VM with the same version of Linux, nginx, openssl.

2) Create a self-signed SSL certificate for the server

3) Verify that the HTTPS server is vulnerable to heartbleed

4) Run a few HTTPS requests against the server

5) Use gcore (or just send SIGABRT) to get a core file of the nginx process

6) Write a tool to check the memory image for remnants of the private key (since I know what it looks like). This may be encoded in several forms: as is from the ssl key file, hex encoded modulus, binary encoded modulus, however the BigNum stuff in OpenSSL stores the modulus, intermediate values used in calculations, etc. I can also check for partial matches since I know what the full key looks like.

7) Run the heartbleed client against the site to extract some chunks of memory, there are various strategies for this:-

a) Repeatedly grab the largest (65535) bytes of memory each time

b) Repeatedly grab different sizes (8KB, 16KB, etc) depending on the bucket sizes for OpenSSL's freelist wrapper around malloc.

c) Vary the request size (lots more headers, etc) to try and get different chunks of memory returned.

d) Occasionally restart nginx

8) Once I can reliably (for whatever value of reliably that is) get the key from my own server, I then modify the test for success from a comparison against the known private key, to a test which involves decrypting a string that was the result of encrypting some known plaintext with the known public key. That'll be slower, but still possible.

9) Run that analysis against real data retreived from the challenge server. The data (using the various strategies in #7) can be obtained in the background whilst I'm developing #1-#8. You can't rely on having sole access to the server so whatever strategy you use may be perturbed by other people performing requests.

10) Repeat #1-#8 for Apache and any other web server that is vulnerable to heartbleed.

This does work on the assumption that the key (in whatever form it is in) will be returned as a contiguous block of memory. Trying to patch together chunks of memory to look for the key will be much much harder unless there's significant overlap and it's easy to detect what/where a key is somehow.
High speed rail is often implemented using dedicated track wherever possible - either brand new or upgraded and restricted to other traffic types:

A closely sitting and smooth train wheel gets damaged pretty quickly traveling on track that is accustomed to freight traffic. That now-damaged wheel then goes on to damage the polished high speed track, which then further damages other trains' wheels in a vicious circle.

China's new high speed train network, for example, is almost all dedicated track (a large part newly constructed routes) with existing track used only where there are space constraints (for example, a city centre station).
Help me surprise Catherine
One difference that I am aware of is that OpenTransactions uses the Bitcoin blockchain and the other two are supposed to have their own blockchain. But it's hard to get details of how these things are supposed to work.
Bullshit. There's something that was left unsaid in the article, specifically "best practices".

If the NTSB used the "best practices" mantra like the software industry did, then there would be no stick shakers, ground proximity warnings, and collision avoidance systems. Thousands more would be dead without such automation. It's amazing that the software industry so often responds to such problems by saying we programmers should do one more thing, and do it consistently without fail. (Then no concrete steps are taken.) Aren't programs better suited to such tasks? We should be using languages or libraries that are memory-safe and give us automatic means of avoiding timing attacks.

When we in the software industry fix widespread safety issues, our answer shouldn't be, "we should've done X, those people are to blame for not doing X, let's all just do it from here on out." If we were fire marshals, there would be no mandatory fire alarms, emergency exits, and occupancy regulations. Instead we'd "tsk tsk" and talk about how those poor victims were "doing it wrong."

If governments were exploiting this bug, they were doing the opposite of what they should've been doing: fixing it once and for all. I've read several users comment that an Ada implementation of TLS would avoid the same class of errors entirely.
For me all connection to amazon.com is unencrypted :o Did they just remove ssl for now?
I have seen the writing on the wall for quite some time, as we use NCCI [1] as well as other data provided by NTIS. Myself and many of my colleagues are eagerly awaiting what will happen, as we make software that is directly impacted by this, and need to know how to make sure we can have continuous operation for our customers. It will be an interesting transition, but as this data usually goes, probably a challenging one.

[1] http://www.ntis.gov/pdf/NCC_HOPPS_IOCE_Subscriber_Discontinu...
I'd take $5000 to quit a job in an Amazon warehouse:

http://www.huffingtonpost.co.uk/2013/11/25/amazon-staff-inve...

http://www.forbes.com/sites/eamonnfingleton/2013/11/25/amazo...

http://www.dailymail.co.uk/news/article-2512959/Walk-11-mile...

http://www.vice.com/en_uk/read/jean-baptiste-malet-amazon-wa...

:-) ... :-(
I wish I had this when I was figuring out how it all works. I'll definitely point it friends who start with CSS.
I think it would have to be a cryptocurrency that was amenable to CPU mining. That rules out most of the existing ones, although it's possible to create a new one specifically for this.

The cryptocurrency would not be tied to the project in any way. Users could obviously disable the mining code, and many would. How would this be different from just suggesting to people that they could mine cryptocurrencies however they like and donate the proceeds to the project?

edit: I'd also be concerned about the power usage...
According to the article, it's temperature differential that's important. So it works in the desert, which has 50 degree swings between day and night. Many places with high moisture content have much smaller swings in temperature, so it might not work as well in the jungle.
All using the same code would've been smart -- if everyone who depended on that code had been actively aware and contributing to their own rational self interest. Like so many others, I just took it for granted and assumed the OpenSSL guys knew what they were doing. Putting all your eggs in one basket isn't necessarily foolish, if it's some kind of armored, padded, exquisitely engineered basket. It is, if it's a rickety volunteer-made basket.
Quick Hull
I'm game. What's a good way to make a script that intelligently creates garbage data, so that the daemon has to keep syncing with the server? Try to make it look decently random? I don't know how smart the dropbox daemon is.
Isn't the generated/collected water like condensed water free of any kind of salts etc. that would naturally occur in ground/drinking water, so shouldn't it be unsafe to drink large amounts of it (much like it is unsafe to drink large amounts of salt/sea water due to the saline imbalance)?

I wonder how/if they address this?
LogmeOnce – Password Manager + Secure USB + Phone Charger
Teen Drinking Linked To Music
> If we can have internationally coordinated efforts such as NATO, why can't we have them for extremely important/basic elements of our society such as technology?

This is a very interesting question. The answer, most likely, is that the perception of security moves slower than the security concept[s] itself.

We come from an era where security was in most part physical, and we're transitioning to an era where it's much more logical; society though, is having a hard time adapting to the change.

For this reason, a technologist may see as obvious to take care or OpenSSL more than, say, building a tank, while a politician is stuck in with the latter only.

Also, I think we're only scratching the surface here. It's interesting, for example, to think of a parallel between the interests in keeping the world insecure. In practical terms, NSA has certainly a great interest in keeping security software broken even if used by the people it's supposed to protect; I wonder what was the parallel of this, 50 years ago, and especially, how is society going to react over the time.
It's a hack on display refresh rate. I think your monitor might have a higher display rate than 60 Hz. Try on a different device.

Normally it should generate 4 different rotating circles.
Or not at all. "Jobs' sidekick died. The end of an era. That's it"
Yes please! But make it dirt simple, I dont want to think about fashion. I send in a selfie of myself in my undies, input my height and weight and the system gives me back a full set of clothes to buy, what they cost and where I can find them closest to my location, optimized for a maximum cost/benefit ratio. Anything more involved than that (such as reading an eBook) and I'm not interested.
What if you tried to transcribe the music solely from Fourier transform of the audio source? I expect the piano has an abundance of harmonics, but there should be some way to distinguish them from the keys. Hasn't someone done it already?
Thats fascinating, do you happen to remember the reference?
> I never understood why people use StartSSL

The difference between 4,99$ and 0$. I can bear a slow loading page that I can barely navigate through as long as I can save 4,99$ (or more).
If anything I'm pissed at large companies relying on a piece of software that's barely funded.
In a city center, your average speed will be substantially less than 20mph anyway no matter how fast you drive (unless you violate laws, running through lights and speeding) due to congestion, traffic lights, etc. A 20mph isn't going to make much of a change to average travel speeds.

Most likely, however, you're not going to be driving 20 miles in a city center. If you're driving more than 10 miles, you'll probably want to use a highway, and the US highway system is extensive enough that you can.

As for biking, I have less of a problem with people biking over 20mph in the city. (However, you're correct that, in practice, there's no way someone's going to average 20mph for a city bike commute. Most people aren't in good enough shape to sustain 20mph on the flat.) I regularly hit 30-35mph on downhills (say, Central Park at the north end) because I know what I and the bike can handle. Bikes are small and agile (it's easy to swerve and avoid hitting someone) and much less massive than a car.
Individuals targeted as San Francisco tech money protests intensify
How to move off of Dropbox – Drop Condoleezza Rice or we will #dropdropbox
I'm really looking "forward" to the GNAA's return.
Popcorn-app repository taken down again and main developer missing
It's fascinating to realise the amount of herd-like behaviour there is in all walks. Crypto switching clearly had some promise but was essentially abandoned when semiconductors reached a form of escape velocity. The same can be seen in Russian work on phages instead of anti-bacteria - strange that we do not parallelise our r&d
This looks like an excellent opportunity to weed out bad CAs and drop them from the trust stores. :)
I honestly can't think of anything I've ever read about the guy that doesn't make me think that.

I also don't get the hero worship on HN for the guy, there are other actual hackers for worthier (in my opinion of course) of respect (as an aside I think Wozniak is worth far more respect than someone like Jobs).

Pretty trinkets combined with aspirational marketing and a form always beats function attitude and somehow this guy is a hero, never could figure it out.
NATO was set up in opposition to the Soviets / Warsaw Pact. It's "internationally coordinated" amoung some countries, not all.
Another nice thing is you can see what the money goes on. "Where does out €5,000 donation go?" "We'll find and fix bugs in software you use."
Node.js team member cracks Heartbleed challenge
That number was an upper bound estimate obtained by visually integrating the commit history, it is entirely possible that it is significantly lower.
No encryption here as well.
> were these healthy people or were the sick averaged in?

Unless you have a magical cureall and were wondering whether to bother taking it, that's not really relevant. You're going to get sick as you get older.
I suspect a lot of it has to do with Self identification with Steve Jobs and people like him, so an attack on Jobs is an indirect attack on them.

Personally I think Jobs was an over hyped marketing manager (with perhaps a true gift for getting talented people to do the work).

There are dozens of people in the computer industry that I respect far more who will never get 1/100th of the adulation (and I'm not sure most of them would want it).

Look at the contributions of people like John Backus, Edgar Codd or Maurice Wilkes and of course Kernighan and Ritchie, those people (to me) are worth far more respect.
There have been remote code execution vulnerabilities in OpenSSL in the past, yet no one panicked. Those vulnerabilities gave you what heartbleed does and more. The worst part about heartbleed is that its easy to exploit and the tools to do it are readily available. Its bad, as I state, but not the end of the world. The main point of the post was to correct the public analysis of the freelist implementation.

Please don't mistake a poor attempt at humor for ego.
Here all is just fine. It shows as verified and encrypted. I have enabled checking the verification list in Chrome.

Fingerprint is:

C1 4C 4A 4D 63 63 E4 B4 CD 23 02 1A 2F 0A 0E 9A
AB FB BE D7 0E 59 10 A3 20 01 EB CC 8D 08 DC E2
It says right on the homepage "no virtual machine involved". So why is "VM" in the name? Surely that's just misleading?
Url from this post (https://s3.amazonaws.com/) redirects to HTTP://aws.amazon.com/s3/

307 Temporary Redirect

Location: http://aws.amazon.com/s3 [following]

Going directly to https://aws.amazon.com/s3/ keeps the SSL cert, which does not seem to be revoked and is issued at 4/8/14.

SHA1 fingerprint:

E0 D2 E0 2E 20 F2 CE 80 AE 16 93 CA 86 2C 5A 14 54 26 28 F5

EDIT: Now 45 minutes later https://s3.amazonaws.com responded with a REVOKED certificate issued 4/8/14, SHA1 fingerprint:

0C F0 6A F0 5C C4 C4 44 E1 DB 92 25 F0 99 4F EC
6B 5E 4A B5

I failed to grab initial https://s3.amazonaws.com cert that passed chrome revocation list check. Which could have been also due to the revocation service timeout because in that case AFAIK no revocation check is performed and cert is silently accepted.
> If you have to restrict the length, use maxlength in the input field.

This bit is really bad advice. Maxlength stops you from typing but doesn't give you any indication it's happening, so I'd be happily typing out a 20 character password without realizing it's being lopped off somewhere.

If they ever lift the maxlength restriction, my password suddenly stops working for no apparent reason.
Actually, please do NOT have a maxlength on your password field. Instead, if the contents are too long, disable the submit button and tell me my password is too long. Why? Because I never actually type in a password. I generate a long one and copy & paste it in. And when you put a max length on the field, I think my password is FooBarBazBatAwesome, and you think my password is FooBarBazBat.... and that is going to screw me.

I've had this happen on more than one occasion. For God's sake, do not put a max length on your password field. It silently drops any characters that are too long without notifying the user that it's doing so.
Anyone know if anything became of this? The linked pdf 404's :/

http://www.gadgetnutz.com/2006/10/09/wind-traps-become-reali...
> If you have to restrict the length, use maxlength in the input field.

The problem with this approach is that, for longer passwords, the user may not be aware that the maxlength property has prevented the field accepting the last n characters of their password. They may believe they have successfully submitted their entire password. In other words, they may believe their password is

i_love_peanut_butter_and_j3lly

but it's actually

i_love_peanut_butter_a

This may work for a time, but is likely to cause problems down the road.
Ha! Glad someone else agrees :)
Bitcoin Predictions for 2014
Where are the African Speakers at Tech Events?
Sort of odd that it wants to go negative on other efforts. Doesn't really add to the story but seems to be all about a few cheap shots.
Why would you have to restrict the length at all? I could see something like a few thousand characters max, to avoid making it easy to strain the server, but other than that, you're not supposed to store it as is anyway, and if you hash it, the input length doesn't really matter... what am I missing?
Like so many others, I just took it for granted and
assumed the OpenSSL guys knew what they were doing.

While the mantra "don't work on your own security code, you'll get it wrong, use a library instead" is generally good advice for programmers, I imagine it makes it harder for the libraries to recruit contributors.
I saw the same thing maybe 5 minutes ago but it has since been resolved it seems.
Owncloud is the best solution for a dropbox replacement imo
IIRC, they later used symbol versioning so that only newly compiled programs get the real memcpy. Older programs get a fake memcpy which simply calls memmove, which is what Flash should have been calling instead of memcpy.
I am guessing that Condi Rice is a concern for a miniscule fraction of the miniscule fraction of dropbox users who even know about her being on the board...
YES!!!! TELL US THE DAMN PASSWORD RESTRICTIONS ON THE FORM BEFORE THE PASSWORD IS ENTERED!!

I hate hate hate hate (can't you tell I really hate it) when I use LastPass's awesome password generation, only to save and submit and then be told by the site the password is bad for whatever reason.

Please just do this. THEN we can start talking about those other restrictions (why is my password limited to 16 or even 32 characters?!?!).

Lots of frustration here, I'm pretty certain it's shared by a lot of people. Does feel better though :)

Now I'm not a web dev but I'm interested and echo the question that someone else posted below - why is there a length restriction on passwords (notwithstanding a restriction to stop strain on the server)?
Autodidact, front-end or back-end, job prospects?
I plan to teach myself either front- or back-end programming with the goal being employment. Now relocation is something I'm willing to do. However, considering my age, 20, will I be taken seriously?

I'm open for any kind of advice or wisdom. .Net seems to be very high in demand. As someone from Europe, how easy would it be to get a job in some start up?
> let's not forget that the mandate for them to be profitable did not exist until just before it started to become impossible for them to do so.

I'd be curious to read more about this. Looks like this isn't the first time the agency has been in the cross-hairs (from 1999) -

http://newsbreaks.infotoday.com/NewsBreaks/Commerce-Departme...
Eric Schmidt is also an advisor to President Barack Obama, who selected Joe Biden as his VP (who voted for the war). Should Google Drive and any other Google-related products be boycotted too?
To reissue a cert without revoking the previous one is like a half-baked cake. Actually, more like a cake that was never placed in the oven - a complete mess of runny eggs with dry flour and inedible. As long as they don't revoke the cert, the attacker could still use it along with its private key (which they potentially stole from you) to do an MITM attack.

It doesn't make sense.

What if a party is harmed by the compromised certificate? Legally whose fault is it if the CA replaced the compromised certificate but failed to revoke it as well?
The web site has severe UX problems.. It is first loading, then loading and again loading... Go back does not work neither.