skysight-inc/HackerNews huggingface dataset:
Hi!

Bounties are always awarded after the bug is disclosed[1].

We constantly[2] upgrade the bounties whenever we feel like we should be paying more, and we will continue to do so. We also increase the rewards from the amounts in the price list if we think they result in a higher impact than what the reporter originally suspected.

We aren't actually trying to out-pay the black market. Overall, our goal is to reward the security community for their time and help for their security research, since we both have the same goal in common of keeping all of us safe (either Google services, or open source/popular software[3]).

And if you are interested, you can follow news on Google's VRP here:
- https://plus.google.com/communities/103663928590757646624

[1] http://www.google.com/about/appsecurity/reward-program/
[2]
- http://googleonlinesecurity.blogspot.com/2010/11/quick-updat...
- http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w...
- http://googleonlinesecurity.blogspot.com/2012/02/celebrating...
- http://googleonlinesecurity.blogspot.com/2012/04/spurring-mo...
- http://googleonlinesecurity.blogspot.com/2013/08/security-re...
- http://googleonlinesecurity.blogspot.com/2013/06/increased-r...
- http://googleonlinesecurity.blogspot.com/2014/02/security-re...
[3]
- http://googleonlinesecurity.blogspot.com/2007/10/auditing-op...
- http://googleonlinesecurity.blogspot.com/2011/08/fuzzing-at-...
- http://googleonlinesecurity.blogspot.com/2013/10/going-beyon...
- http://googleonlinesecurity.blogspot.com/2013/11/even-more-p...
- http://googleonlinesecurity.blogspot.com/2014/01/ffmpeg-and-...
- http://www.google.com/about/appsecurity/research/
I understand you are not looking to make huge profits and I greatly appreciate the idea behind this and your sister program over at Data Science Retreat.

Unfortunately, I am a PhD researcher just finishing their thesis this summer so I would not believe that my financial situation will allow me to pay for both the retreat and living expenses.

Are the folks you attract mostly financially settled i.e. holding down real jobs?
> maybe this is not leaked or it requires a read at the correct time because these buffers might be trashed by another computation.

As far as I can tell, it's certainly possible for intermediate data to be leaked, but it'd require pretty spectacular timing.

That said, I'm having a bit of a hard time understanding why this challenge exists. If the possibility (even remote) exists that key material was leaked in any form, it should be assumed that the key material was leaked in the worst possible way, and that everything is compromised. They seem to agree, having rolled their keys.

The only real effect I can see from this challenge existing is that people will see it and make the assumption that Heartbleed is "not a big deal, because Cloudflare's keys weren't leaked".

In other words, I think this challenge is harmful to security overall; Cloudflare seems to be doing the right thing, but the messaging here is going to cause people to not follow suit.
I don't know about 'popular with Mormons'. That or my friends and I are exceptions. I remember fondly having D&D/MTG/card games/board games nights. I personally love card games and usually have a deck with me. Especial during youth/single group game nights with the whole congregation. I can see this for those that are hyper conservative, but this can work for any religion.
I recently deleted a decade old CGI script called "db" that would execute arbitrary database queries for you. No one remembered it was there.
But will_brown didn't say that Apple was patent trolling. It's perfectly reasonable to respond to Apple's reported impatience with one form of patent scumbucketry by pointing out that they're still cheerfully engaging in a somewhat different form of it themselves.
This might actually be desirable for amazon as it likely helps them keep their employees through the rough holiday season where they probably see a larger than average quit rate. I'd be willing to bet that the choice to quit and receive compensation comes shortly after the holiday season ends, thus dangling a carrot in front of the employees to muscle through.
I don't think it's that strong a network. Drivers are businessmen - they aren't going to shun another app just because it's too much trouble to sign up. So there's big no chicken / egg problem - any competing network with half a chance of taking on Uber will get plenty of drivers.

It's kind of like eBay stores, not the "sell and buy junk from strangers" eBay. And since there's only one product, the customers won't flock to Uber because they want variety.

I'd rate it lower than eBay and far lower than Facebook in terms of the strength of the network.
Chrome 35 will help developers build better mobile Web apps
That's not an opinion, that's just a legal citation. The Court expressly avoided an opinion: "we need not
resolve whether Auernheimer’s conduct involved such a
breach..."
> PolarSSL condones the practice that makes OpenSSL less secure than any other, which is commercial entities not being obligated to give back.

...it really isn't that simple. Many of the mechanisms for obligating commercial entities to give back simply result in those entities ignoring a project from the start. Plenty of projects that don't enforce that obligation receive significant commercial support.
The LHC Has Found a New Particle Unlike Any Other Form of Matter
Epsilon greedy? It's the simplest, but also the most uninteresting bandit algorithm.
Google Glass Available to Anyone in U.S. – for One Day Only
yea, I will follow up with a blog post once everything is sorted out :)
Go ahead and search the net for ASN.1 parser vulnerabilities. I won't wait; you'll be compiling quite a list.

There are worse things to try to implement than ASN.1, but they are mostly related to timing, crypto or memory re-use.
Terrorists can't get money by going to court. Trolls can. It is better to play a small price and stay out of court altogether.
Every major linux distro has a procedure in place for discreetly preparing updates for pre-disclosure security flaws.
I was a rebellious little brat, so my mom's hysteria only increased my interest in D&D and Rock and Roll. I still enjoy these things today so I'd say it worked out well for me.
Luckily functions from <algorithm> don't only work with STL containers; they work with any class that adheres to the STL containers interfaces.
http://www.doerhub.com/for/surgery-boards-app

Is this oral surgery on a ship? The "FR137" marker and door structure suggest that it is.
Why new, open, honest Microsoft is still doing it? Or, judging by this action, may be it's still the same, large company, and openness is just a facade?
Looking for feedback (ideally blog post reviews) of a product I own/maintain in my free time. It helps with product initiation, i.e. project start up questionnaires and proposals.

https://www.getosmosis.com

I'm willing to give out free accounts to people who write reviews, if it's the type of product you'd use.

Email support@getosmosis.com if interested.
HTTPS on the signup form (or everywhere)?
Open Source (Ruby on Rails) RSS Aggregator
I've been working on a website for almost 2 years (on&off). I'm right there at the final push to get it live, but I think I'm just a little burnt out from it. One of the things I'm struggling with is the pricing model I want to use. I'm trying to find that balance of a simple pricing scheme that scales well.
My site was made to run leagues & tourneys, and I'm a single founder. If anyone would like to talk with me on my business model ideas, my email is in my profile or just leave a way to contact you here and I will!

:edit: I wanted to add that I believe I want a dynamic pricing scheme like Heroku's where they have a slider for how many dynos you want. The problem I run into is that I have a couple metrics that I can charge for, I just don't know how to meld them together.
>'They' spin up spot instances which isn't subject to Billing Alerts. You'll need to cancel those spot instances, revoke your AWS credentials, and change your account password," he said.

This doesn't make sense at all. Amazon should let us if monthly bill > X send me a priority email and phone call. Why do they hide behind these dark patterns? I thought they were better than that.
YC at Penn State Startup Week Live Stream
I continue to play today as well, it's a REALLY great hobby for a software engineer in particular, since it involves heavy and somewhat complex rulesets, some minor math, and a great way to socialize with staring at a computer screen. It really makes it easier to connect and talk to others as there is a built and fun subject to talk about. Playing RPG's has improved my life quite a bit since I picked it up again.
Hoe bescherm je best je tuinhout?
I can only guess that this is an RSS reader or something. But even on the http://reederapp.com/ios/ site, there's nothing saying "Reeder is a ...."

I finally found some mention of OPML in the changelog on the iOS page.
Heartbleed Bug: What Can You Do?
What was your experience of the impact that policy had at that company? Anything? Did any lower performers leave to take the incentive?

I've been curious about implementing this at my own company but I'd be interested in someone's actual experience with it, vs. hearing about it from people incentivized to claim it worked well because it was their idea to implement.
Font War: Inside the Design World's $20 Million Divorce
This article is written under the assumption both that Uber's only competition is cabs, and that once cabs are gone (and I agree that this seems inevitable), it will operate as a monopoly. At least in my market (Washington, DC), the former is not the case, and I see no reason to believe the latter will be the case anywhere.

Given that, it's appropriate to evaluate Uber's market-forces claims with a view towards a larger market that includes more players than just Uber. Anecdotally, I've found that their claims about surge pricing mostly hold true: their service, while being priced higher at times of peak demand, seems to generally stay available in a way that cabs or other services don't, and at least sometimes, that has been worth it to me, and I've been willing to pay 2x the price to have a ride in ten minutes. That said, if it weren't, there's always Lyft or Sidecar (or, for the moment, traditional cabs), which would inevitably offer different tradeoffs of price and dispatch time, and I'm free to use any of them instead. If lots of consumers do the same, eventually Uber will lose, or market forces will force it to adjust how it balances availability with price.

In other words, exactly the way a market is supposed to work.
It obviously seems to behave that way, but I wonder why. Much like search there is very little lock in. Nothing stops a user from having 3-4 different car apps, or one third party car app that checks 4 services.

Maybe it is the drivers? If you driver for Uber can you not drive for another service? I could see that tilting things in their favor. Everyone uses Uber because that is where the drivers are and drivers join Uber because that is where the passengers are.
There are multi billion scams exposed once every month. The money spent on space exploration is negligible for people to make a big fuss about it.
My lawyer has been quoting this "may soon be allowed to work" for more than 3 years. My wife & I have given up on it. She's resigned to volunteering & working on hobbies. Considering how split the government is over these matters I doubt we'll see any reform in the next 5 years.
Really appreciate the feedback. (you can also email us at feedback@doerhub.com ) We're thinking about doing that and will ask users as well. The primary reason is because we are making it personal - if you show are great at Perl and want to know more about Marketing we are trying to show you people and projects who know more about the latter and are looking for help in the former. For an early outside prototype (cheaply hosted so traffic crash is likely) you can see here: http://peoplesearch-doerhub.herokuapp.com/viz/ . We want to make people luckier by default, instead of just browsing a growing number of projects in unrelated areas.
there's a saying; practise makes perfect

it applies not only to coding, but also to other areas
Hm. In his introduction, he says, "XML is touted as an external format for representing data." To me that mostly misses the value of XML. I think of it as an interchange format, not a closely-mirror-my-datastructures format. I've used it before when I want a long-lived data format that is mostly annotated text, and I'd happily do it again.

That said, I'm very skeptical of the XML-for-everything school, and nearly murdered a group of engineers who were using XML to transfer data from one spot in an app to another, even though it all ran in the same JVM. So maybe I'm more defending a small subset of XML rather than the XML-industrial complex.
Anatomy of OpenSSL's Heartbleed
It's not that simple. Venue was key to establishing the severity of the crime.
Along the same vein, I recently started a podcast about building hardware and physical products. While it's not specifically about bootstrapping, many of the guests so far have are bootstrappers or Kickstarter-backed. The first episode with Studio Neat has some particularly good insights on the topic: http://edgemade.com
How to promote your conference on social networks
Is there anything you have done that might have compromised your account. Moreover bill could as well been much larger than $5000 i guess.
I began work on a project about two months ago. I'm convinced people would pay for this cryptocurrency-related service.

I'm learning full-stack JS as I go and sometimes I wish I had someone to code with. One problem I see is how to keep my idea mine while getting help from others?
Related to CloudFare, I know what a real CDN is, but I'm not sure what cloudfare does useful at all, ex:

http://halfelf.org/2013/i-dont-understand-cloudflare

http://pergento.wordpress.com/2012/02/01/cloudflare-slowed-d...

http://amix.dk/blog/post/19627

Like they tell you to use CloudFare w/ a CDN. what?
It appears that they are a good marketing company, and OK tech, but not clear to me what.
Compare it to real CDN Fastly or MaxCDN.

So other than marketing, what does Cloudfare do when you pay them?
Their recent movies really boosted how I felt about them.

After several years (after Vista) of staying far away, I decided to give them a try once more with their Windows 7 phone. Totally abandoned and betrayed on that.
There are lots of pragmatic reasons you might want to work at Amazon for a while and then leave for example, someone who's studying and wants to move into some other line of work after graduation. Waiting tables is the stereotypical student support job (partly because of lectures during the day and people preferring to attend restaurants in the evening), but my understanding is that Amazon warehouses run more or less 24-7.

Another way to look at this that doesn't require any cognitive dissonance is that Amazon lets hourly employees accumulate up to 2-3 months of severance pay (I'm not sure how much time that represents because I don't know their hourly rates, but I'm guessing it averages out to something like $12/hour).

I think it's a great program. Besides offering a friendly incentive for unmotivated workers to leave; it improves the confidence of those working there and provides useful transitional assistance to those moving on for career reasons; lower-paid workers often suffer economic disruption even when moving to a better job because they may miss a pay cycle or have to take on new expenses (new work equipment, different clothes, a car or moving to another town), so a cash cushion for such things is a big plus. It's good cheap publicity for Amazon, not to mention they probably retain their ex-employees and their associates as future customers.
Freenode is still using the same certificate after Heartbleed
Can be checked with "openssl s_client -host chat.freenode.net -port 6697 | openssl x509 -text" They updated their vulnerable openssl but did not change their certificate.

Since there seem to be no admin reachable about this, at least the users of freenode should be made aware of this.
Ask HN: Any phishing piggy backing on the Heartbleed yet?
The time right after the Heartbleed bug is probably the best time to harvest a slew of password from everyone. I haven't seen it in the wild yet.
I only regret that I posted but one comment for partisan dickheads to downvote; oh wait here's another one for you.
AT&T isn't a named party and did not bring the suit. Their civil liability is pretty much zero as far as I understand it.

Wrongful prosecution is, for all intents and purposes, impossible to prove.

Because it was overturned on appeal and the determination was not on the merits (ie. what he did isn't actually illegal) but instead on procedural grounds he loses a bunch of options for remedy.
Admittedly, OpenSSL's Apache license allows for that usage case, so it's technically a fair question when comparing alternatives.
I'm really not sure about their ability to set prices
as you suggest.

Perhaps I should clarify.

When I say "make as much money as possible" and "increase revenues" I mean in total across their business, taking into account the loss of customers to other services and damage to their reputation from price-gouging.

Uber does surge pricing because they think the extra profit from customers paying more will exceed the lost profit from customers who go elsewhere or go without.

The CEO only talks about markets and algorithms because it's bad form to say "we put up the price because we know you'll pay it, suckers"
Protecting Derived Credentials without Secure Hardware in Mobile Devices
I think that being able to browse a little - some kind of search function, perhaps - before signing up would be great.
The code used for the paper is actually here: https://github.com/pencilo/ssl

I quit gradschool a month after publishing this so can't comment on what Suman is currently working on, but it looks like it is still mostly my code for generation.

I didn't write the script for using polarSSL but I wrote most the other ones,the testing harness, cert generation and cert crawling, and I can say that polarSSL loved to crash on my weird certs. I almost wanted to remove them from the tested list for being so unreliable.
Too often you seem lame jokes like the original comment that require the belief that NSA is leaps and bounds ahead of the world in infosec AND yet NSA is composed of bumbling morons. NSA would be grossly incompetent if they knew how to retrieve the private key AND then informed the world of their offensive capability. This is a basic tenet of intelligence operations, you do not publicize your capabilities to your adversaries.

The renowned clandestine operative B.Smalls, eloquently stated rule #2:

Never let 'em know your next move
Don't you know bad boys move in silence and violence?
Free market basics would be "this it the current price for your services, would like you like to provide supply at this price?". This is more like your boss telling you to get back to work because it's busy.
Anyone know of a quick way to force nginx to restart?
The instance was spun up on April 2, but Heartbleed wasn't disclosed for almost a week later. I highly doubt anybody used the Heartbleed 0-day to access your account.
I think I'd have the same problem. If it's not got 88 keys or strings I'm probably not going to use it.
Meritocracy is the software engineer’s delusion.
>Patent Trolling was defined due to the 'trolls' being "non-practicing entities"

Though likely this is the commonly accepted definition, for all practical purposes this very naive definition. Perhaps not the case with Apple and the rectangular design, for purpose of legal protection, most patents are placed into entities that do nothing other than hold and license patents. (e.g. company A files patent 1, then assigns patent 1 to company A1 which in turn licenses it to company A the original inventor). This is elementary protection of intellectual property and legitimate; however, under your definition this makes company A1 a patent troll because the entity is non-practicing and only licenses and protects its patent.

According to the article Apple previously invested in IV patent funds, and those patent funds are non-practicing entities.

Conflating a specific lawsuit does not lump every action as "patents are bad" as I used a specific example based on the merits. And yes I admit it does not fall under your definition of troll, but I will continue to say a company is a troll who files, buys and enforces patents which are essential, obvious, and a copy of prior art already in the stream of commerce.
I was suggesting that The Economist knows how to write link bait articles that generate views, and that this article which offers nothing new is an application of that skill.

Of course I was down-voted: HN's readership doesn't like to be told that it's a trivially exploitable source of clicks.
It all depends on what your goal of the taxi market is.

From a regulatory standpoint, the role of taxi regulations is to manage supply in a two-sided market. The goal of managing this is often to balance availability of taxis with the ability of the taxi drivers/companies to make a profit without gouging the customer. Uber just formalizes the type of price gouging that these regulations are designed to prevent. It's consumer-hostile to take a market where fixed prices are the expectation and then say "Oh, well everyone else needs a taxi right now too... so you have to pay more." I'm not saying anything about its economic viability, but it makes the user experience of Uber suck ass.

More problematic is the attitude many taxi drivers take towards money. Uber assumes that every driver is trying to maximize profit; which is not always the case. In my experience (and I take taxis on a daily basis in many cities) the prevalent attitude is "well I needed to make $800 this week to pay my bills. I've made $800, so I'm going to stop working and go hang out with my family instead." Taxis drivers are generally independent contractors, so they can do this. If this happens in a place with a regulated number of drivers, helping them maximize profit quickly reduces the overall availability of taxis, again driving up prices.

Frankly, I hate using Uber. Whenever I need it, the price is jacked up to ridiculousness thanks to surge pricing. That makes it unreliable to me because I'm not paying $50 for a 3 mile cab ride. It's gotten to the point where I usually don't check Uber anymore. Thankfully, most of the local cab companies have similar mapping apps now that replicate enough of Uber's functionality that I am willing to use them.
A Tale Of 2 Languages: What A Middle School Class Learned When Developing An App
So productive... never posts on Hacker News... Hmmm...