skysight-inc/HackerNews huggingface dataset:
> > Your employer is sponsoring a lot of your learnings in a specific area, so he's entitled to all your ideas in that area

> No, he is not on either count.

Yes they are... are you honestly trying to tell us you've learned jack all at your current employer? No new frameworks, coding practices, algorithms? Learnt absolutely nothing about how various patterns of software writing pan out in production?

If you've learned absolutely nothing, you have to be one of the most useless developers your employer has. I find that impossible to believe.

> > that's what your paid for.

> I don't know you, but I'm paid for the work I produce, I'd be really happy if I could be paid for learning stuff and not doing shit.

No, you're being paid for your skills and abilities. That includes your learning ability. It's not "learning stuff and not doing shit", it's "learn stuff as you're doing shit". Everyone does it. A company can't guarantee where or what it's going to be working on next year or so, the market always changes. What they do have is staff capital, including hopefully a team of capable programmers that can do whatever the changing market requires, be it picking up a new language, optimising algorithms, etc. That's what people hiring and employing staff are looking for.
If you're not bringing all your abilities to the job, including your ability to learn, then you've been working under really crappy bosses who have been letting you get away with it.

In this particular case he's working on a CI system both in his day job and his out-of-hours work. Are you seriously trying to tell us he learned absolutely nothing about CI during the day time, and only learned stuff out-of-hours? That he gained absolutely nothing from his colleagues? Operational aspects of the software? UI?
Non-compete is a somewhat generalized term being used here, but it can mean what you referenced ("don't poach customers") as well as "don't steal our product ideas". These are sometimes called NDA or PIIA (1) which might be better representations of what we are talking about here. In this case, the company is claiming that he stole their code (an 'invention' or 'property' of the company) for the benefit of some other party.

NDA or PIIA agreements are common in software development.

1 - http://en.wikipedia.org/wiki/Non-disclosure_agreement
Yeah, that might actually be a good idea, thanks!

I'm 100% on http://bipsync.com (as I have been for the last year or two), a startup initially targeted at Hedge Fund analysts and other professional investors. We were lucky enough to raise a seven figure seed round, so have had the time to go through quite a lengthy customer development phase with some reference customers to really nail the product-market fit. We'll have a public beta out later this year.
If they were that good they would have patched heartbleed a lot sooner.
I remember reading this as a teenager and buying my first keychain lockpick set. One of my favorite sayings is that, "In order for a locksmith to fix a lock, he must first understand it's inner workings. Just like a locksmith, before we can understand X, we must understand how it works first."

I fell out of practice, but whenever I cruise by a hacker space with a lockpick area I will try and take the time to test my abilities. These days lock technology makes some locks very difficult (double-mushroom pins, etc), so I usually can only do the medium difficulty locks.

I had amassed a huge collection of lock/key templates and even some stuff about safecracking, but unfortunately had a hdd crash and lost most of it.

The bottom line with lockpicking, like other things, is that nothing beats practice.
Your own source for the fourth point, the map of offices, actually does show an office in upstate New York. Look again at http://appendto.com/wp-content/uploads/2013/12/100-Remote.pn...
The fact that people can be rejected for jobs over stupid reasons (too young, too old, too many prior jobs, too few prior jobs, not enough or wrong pedigree, too much pedigree) indicates a surplus.

In a real talent shortage, you don't need a PhD from Stanford to do interesting work. Where you're from doesn't matter, because there's so much demand for people to work on hard things.

There were plenty of smart state-school grads working on NASA programs with much more at stake than a fucking VC-funded web app. When demand for talent is high, that image stuff doesn't matter.
Personal time, is personal time, and none of the employers business even if moonlighting for a competitor. If the employer has a say over your personal time then you have no personal time and the employer owns you.
I think the legality matters less and having feelings hurt matters more. If someone pays you to build something, and you build a free version on the side, they're really subsidizing a free competitor to their product. That's going to hurt people's feelings. And they're going to want to hurt your feelings too, maybe by burying you in paperwork.
You can get around the back button part by rooting and allowing double tap of back arrow to jump between last open application. This solved that pain point for me
Drinking whiskey and dancing with your BFF
I think he's referring to some people's inability to balance technical issues and product commitments (deadlines).

Focusing solely on the means and disregarding the ends is a good way to not deliver anything useful. Most times, things need to be good enough, not technically perfect...
Non-competes, as applied to tech workers in Massachusetts, essentially say from start, to two years after you quit your job, you will NOT work on anything similar, for anybody. (Depending on the contract you signed.)

(Current Governor of Mass is looking to change this.)
Is this the only reported case of malicious use of Heartbleed so far? (Besides US government agencies allegedly)

If so, is it safe to say that this crisis was dealt with rather well? Or is it just too early to know how many sites were actually attacked?
Huge ramifications for religion. Thinking of Mark 8:22. To know God, you must become... We have to be ok with this at some point.
> No way. Employer is not entitled to all java code just because he paid me to java certification. Employer to all my products forever just because he paid my college or whatever.

Your understanding of "specific area" is quite broad. I thought more along the lines "his employer paid him to do research and development for CI-Systems", so he should not in his spare time build a competing CI-System.

> I am paid for work done for employer. I'm not own by him.

Where did I say so? You're certainly not owned by your employer, you're not a slave. But you can't go and build the same thing at home and give it away for free as you're building at work and get paid for. Even for a construction guy that would be a problem. Undercutting your employer with knowledge gained at work? Do you think any employer would be fine with that?
They did 8 test flights in 2012 and 2013, and they were pretty successful, so I'm not sure what else there was to test at this point.
They should do it only in situations where it doesn't change the program behavior. I use memset frequently in C just to be safe, but if it's written to later on before it's ever read from, the compiler can optimize that away. I'm guessing their recommendation here is if you did something like

char* plain_text = malloc(size);
///do stuff with plain_text
memset(plain_text, 0, size);
free(plain_text);

For most programs that last memset is unnecessary (and may even be unnecessary according to the standard, but it's probably implementation defined, not undefined behavior) and it makes sense for the compiler to optimize it away. But for crypto purposes you have to be afraid of someone being able to read plain_text later, so the memset is important
This is pretty standardized in many US-based software jobs - the employer gives you an Assignment of Inventions bit of paper in which you agree they own a chunk of your brain, you add additional bits of paper where you and the employer agree to exclude specific things, say, your personal open-source groupon for kittens. It's usually routine and painless.
Management team is here

http://appendto.com/team/

I guess go ahead and find where one of them contributed to prop 8 or something.

According to the readme, the guy only worked on the repo for a week while he worked there. Shouldn't be too hard to redo a week's worth of work. Maybe easier than undoing the damage being done to appendto's reputation by their scumbag policies.
This is IMHO bigger than Apollo. The moon missions were an expensive one-shot, while this has the potential to truly open the frontier.
Somebody more knowledgeable please correct me if I'm wrong, but as I understand it:

If you're using AES-128, if you have a random password with a 128 bits of entropy it shouldn't matter what key derivation function you use. That means, if your password can contain any printable ASCII character, a password length of 20 would be sufficient [1].

The huge caveat here is that the password has to be random, and most people are either incapable of remembering such a password or have no way of securely storing it.

But I have no qualifications in this area, so don't take my word for it...

[1] http://en.wikipedia.org/wiki/Password_strength#Entropy_as_a_...
> That is, how are the intermediate certificates supposed to be revoked if certificate revocation does not work relibably ?

It's a much smaller amount of information, so a normal CRL can be used effectively.

You really cannot use a CRL to revoke millions of certs, but you can use them to revoke a few hundred.
var i=0;
var b = {};
b.valueOf = function () {
return ++i;
};
if (b==1 && b==2) { console.log("success")}
> If his employer had said ...

Paper, ink, and signatures, or it didn't happen.
Perhaps they are doing something reasonable knowing that developers inevitably want to play with the new hotness and will upgrade.

I watch the phpstorm/pycharm EAP's like a hawk as they are constantly adding stuff that will make me hand over money :).
Show HN: Momentum – Automated marketing for solo founders
Hi HN, today I'm launching Momentum, a new service to help you find users and customers for your apps and services.

Check it out - http://momentum.getgini.com

I have seen many developers here on HN who build awesome stuff but then struggle with the marketing.

Momentum is designed for solo developers who don't have the time or skills for promoting their apps and services. It helps you find the most relevant blogs, websites, forums, journalists, social influencers in your target market. It also makes a tailored content marketing plan and helps you optimise your marketing site.

It's basically like Hubspot for solo entrepreneurs.

I'd love for you to check it out and give me your feedback. Thanks!
The IPC implementation is Binder, and I believe the overhead, even in the G1 days was microseconds.
That's not a rare attitude ("I never hire unlucky people"). I'd imagine that VCs are the same way.

Yes, you'll exclude good people if you cop that attitude, because good people often get unlucky. However, the people you get will be terrified (and manipulable). The purpose of back channel reference checking (or age discrimination) isn't to get good people. It's to scare the shit out of the people you have, so they do what you say without question.
Shouldn't we name names in this case? This behaviour should be part of the company's public image. Or does that just greatly increase the legal risk for the author?
Clickable link - http://momentum.getgini.com
Fixing IT – How to Make a Monster (Customer)
>Personal time, is personal time, and none of the employers business even if moonlighting for a competitor.

How are you proving that you did not use internal company knowledge to build the competing product? This is a legal nightmare, just do yourself a favor and don't do it. Or do you also think that NDA-clauses for employees are invalid?
It's called deniable encryption[1]. TrueCrypt supports it[2]. Bruce S is not a fan of their implementation, however[3].

[1] http://en.wikipedia.org/wiki/Deniable_encryption

[2] http://www.truecrypt.org/docs/plausible-deniability

[3] https://www.schneier.com/blog/archives/2008/07/truecrypts_de...
Do you have any insight into what would be the effect of this on Sex Reassignment Surgeries?
Surprisingly, at least to me, I think the chapters on marketing are some of the more interesting ones for the HN audience, and have aged pretty well.

It's quite a high level book, so doesn't go into anything in TOO much detail, but instead is supposed to give an entrepreneur - even non-technical - a good understanding of most aspects of building a web app (or at least, what that consisted of a few years ago).

The dev chapters probably won't hold much interest to HN visitors (as they'll know much of the advice), but the marketing ones, maybe some of the design ones, might have some new insights if you've been focusing mostly on tech in your day to day work.
Ah this is another case of people not reading long legal contracts that they sign. I would have been surprised if this wasn't standard in the EU as well as Asia
.
So by your reasoning he can never work in that field ever again because of the "proprietary" information he may have.

Can we apply that to bricklayers as well?

They might have "proprietary" information on how to make an arch or build a stable house or how the company is structured and organized so they probably shouldn't be allowed to work for anybody else in that field ever again.
Shame on them for not wanting an employee to take what they've learned at work (on a monetised product) and release it open source? The tech stack is largely irrelevant, the products are in the exact same domain.

I think any company would be rightly pissed off if their employees did that. Can you imagine github, for example, being happy for one of their employees to be working on a complete web front-end / issues tracking system for git, in their spare time and releasing it open source, provided it was written in Java?
Or Atlassian being happy for one of their employees writing a complete ticketing system in their spare time, and releasing it open source provided it was written in javascript?

Really?
Sorry, Google. Enough is enough.
Still, using Proguard optimization with Dalvik is ill advised.
Time isn't the only corporate asset he could have utilized to create his competing code. He might have utilized corporate-funded computers, LAN hardware, Internet access/bandwidth, etc. When I worked for a major Internet corporation I signed a contract specifically stating that anything I created using any corporate resources belonged to the company. Thus, when I worked on open source stuff, I did it from home using my own computer on my own time. Did the author sign such a contract, or violate such a contract by using company assets other than business hours? We just don't know.
They fail to mention it causes hypegasms :-) But more seriously, it is going to change the world over time, and carbon based electronics. But I am not sure why this article other than to mention Samsung's press releases (http://www.samsung.com/us/aboutsamsung/news/newsIrRead.do?ne...) or to just give out a tech 'feel good' vibe.
I'm not sure that my attitude to "we own all your stuff" clauses is directly relevant to the case at hand, no.

I agree entirely that the employer has the right to ask you not to compete while you're still employed by them. I won't sign non-competes that extend past employment, but I don't think it's unreasonable to sign one during employment. Particularly not for products (FOSS or otherwise) that directly compete with the very thing you're working on now.
Considering the significance of the vulnerability, the only thing I can say is the government is extremely lucky that the number is only 900. For Canadians, SIN numbers are about as critical as it gets.
I think you're on to something there.

From my observations, feminism seems to place the woman as "damaged" or "in a state of victimhood". That viewpoint seems.. wrong. Why would I see myself as lesser and try to lower others around me so I look better?
In fact, there seems to already be a Sublime Text plugin that uses ctags to offer a function list: https://github.com/SublimeText/CTags. It apparently shows the tags in the file tree instead of in a separate pane, which some people may not prefer. But it sounds like basically what ozh wants.
Who's Mark 8? Also, which God? Are you talking about a specific novel or just general gnosticism or mythology?
> The Canadian government runs several PKIs with tens of thousands of active certs, many thousands of revoked, no problems at all, because of CDPs.

Because thousands is off by several orders of magnitude.

Real public CAs are going to have to contend with revoking millions of certificates.

Each revocation cert is about 1KiB, so that's 1GiB of revocation data per CA.

That obviously does not scale.
Microsoft taught us all to "Never attribute to malice...".

However, after reading the related RFC I've rarely seen such over-designed garbage. I'll be amazed if OpenSSL is the only implementation with a heartbeat exploit.

As to the implementation. It just makes me queasy to see a callback before any validation code (bounds checking). It's still that way in the latest fix. I physically can't get past that to even ponder the rest.

At least the new comment has the right idea:

/* Read type and payload length first /

Unfortunately... It's definitely not first.

> If the payload_length of a received HeartbeatMessage
> is too large, the received HeartbeatMessage MUST be
> discarded silently.

Wow, on so many levels just wow. Terminate the connection forcibly anyone? return ALL_HELL_BROKE_LOOSE & YOURE_UNDER_ATTACK? No, guess that's not helpful here...

/ Read type and payload length first (now w/accuracy /
if (1 + 2 + 16 > s->s3->rrec.length)
for( int borken = 0;;) return 1 / borken;

if (s->msg_callback)
...

There, fixed that for ya.

Yet, there's ANOTHER line that stops me cold:

unsigned char p = &s->s3->rrec.data[0], *pl;

I don't suppose s or s3 could EVER be NULL? Of course, USUALLY that would just cause some kind of app crash...
Wow.

Remind me never to work in Germany!
(It comes up once in a while. I probably wasn't going to anyway, but this is further reason not to)
... served, of course via HTTP only ...
I'm using an experimental Firefox add-on that shows the comments in the right pane - they can expand / collapse. https://addons.mozilla.org/en-US/firefox/addon/hacker-news-r...
Remember the stage being retrieved to ground level weighs a lot less than the stage sitting on the launch pad, because it's empty. Grasshopper took off and landed on the same (permanently extended) legs, so its legs, like the undercarriage of an aircraft, had to be able to support not only the engine and big hollow tank, but a fuel load.

But the landing legs on the Falcon 9 first stage don't have to carry the weight of fuel fuel, never mind the weight of the second stage and payload and their fuel -- it launches from a pad and the legs only carry the dry stage at landing.

The empty first stage is bulky, but relatively light.

The real question in my mind is how much extra fuel it takes to re-light the first stage motor after separation and decelerate it to the point where it can land vertically. There's got to be quite a weight penalty in there. (Which AIUI is why the second-gen Falcon 9 first stage tankage is 30% bigger than the original. Fuel is cheap compared to precision engineering.)
There are enough alternatives already. It's true. We could all just move on.
You can't be on the hook for intellectual property. Having the right to the IP you gained off hours does not mean that they're on the hook for your actions in that time, even if your actions were a requisite to gain that IP.

The clauses are usually more nuanced because the blanket "we own all you ever create" is - rightfully - considered to broad and unenforceable.
Some apps based on the official HN API are listed here:
https://hn.algolia.io/cool_apps
They are working on the next version.
There are TWO Hugin / Huginn top articles on HN today. Is this a coincidence?
Ask HN: Why no Cloud Storage Love apart from Dropbox and GDrive?
Unless I am missing something. MediaFire currently offer of $2.5 / TB, even without the discount their $5 /TB is even cheaper then Google Drive.

I see no mention or news of it.

Similar thing happen to OVH Hubic, which is even cheaper at $13.5 / month for 10TB.

Why aren't these being used or talk about more often? Am i missing anything?
Also, I forgot to mention, the last chapter - the marketing case study - is an interview with everyone's favorite HN user, patio11 !
See commit log. (you're on HN after all)
"Meh, Mac"? What are you, 12?
A nice, even-handed summary of the situation.

TBH, it never would have even occurred to me to work on an open-source project that directly competes with what I do to pay the bills. I've got a noncompete, of course, but even without that it strikes me as a violation of basic business ethics.

And even without that, as much as I enjoy programming after hours, working on the same problem you spend your work days hacking on seems like such a recipe for burn-out.
Akamai Heartbleed patch not a fix after all
Learning to Press Doorbell Buttons
There is an official HN API - no need to scrape. :-)

https://hn.algolia.io/cool_apps

I found a Firefox add-on here that is similar to this site:

https://addons.mozilla.org/en-US/firefox/addon/hacker-news-r...
> If you are interested in this, take a look at BBC coverage of the referendum

They quoted a single woman who claimed the Ukrainian government are nazis. Sounds legit.

> have friends who still live there. The overall sentiment

I lived in Australia for 29 years and everyone I know thinks Tony Abbot is a fucking idiot, so he must have rigged the election, right? How many of the 2 million Crimean people do you know well enough to have had discussions about their thoughts on Russia? Anything over a million and you're probably safe.

> The turnout and voting numbers were in fact all legit and no one was going to the voting booths under a gunpoint.

a) facts have to be proven. b) who says you need a gun to rig a poll?

Apart from being illegal according to their own constitution, the referendum gave no option to maintain the status quo - only to become part of Russia, or to become independent. That sounds amazingly legit.

A Russian citizen in Crimea on a one year visa was allowed to vote, which is illegal. There are confirmed reports of people having their identification confiscated before they could vote.

Add to this - Russia invited "observers" to validate the legitimacy of the vote. The leader of the group invited to observe is a Neo Nazi and Adolf Hitler admirer. The "observers" from the group were a Frenchman, a Spaniard and a Hungarian. All three are former members of neo-Nazi parties, and currently members of far-right-wing political parties. Still legit though right?

And of course every country on the UN security council except China and Russia must be just saying it's illegal and illegitimate for shits and giggles, not because of any evidence.
JS Recipes – JavaScript tutorials for backend and frontend development
Image Analytics Service Curalate Adds Tumblr Support
Show HN: "Help Me Out" as a service.
I love the history/nostalgia in this font, but after opening a Gnome Terminal with the .ttf font, its unusable. The characters are full of horizontal 'scan lines' which look neat when zoomed in but make the font fade to almost nothing on a black background. Ironically the sceenshot in the story for the terminal shows solid characters.
How about "an eye for an eye" (Matthew 5:38, apparently)?

- So sorry about your eye! You're half-blind now! I should really stop running with scissors.

- Ah, that old thing? I was going to get a new one anyway.