skysight-inc/HackerNews huggingface dataset:
How to free up more storage on your iPhone
List of sites affected by Heartbleed
Source: http://news.msn.com/science-technology/how-to-tell-if-heartbleed-could-have-stolen-your-password-and-when-it%e2%80%99s-safe-to-change-it
Tesla is facing opposition to their direct-sales practices in most states right now from the entrenched dealership lobby. It would be mighty useful to have on legal record that the lack of dealerships is materially significant to their ability to fulfill a portion of consumer protection law, whether it's true or not.
Oh, this is my writeup. Please let me know if you see anything inaccurate or strange.
It looks like they had been logging since January and it only started a few weeks ago;

>We haven't observed this during Jan, Feb and first half of March.
Samsung Galaxy S5 officially gets Wireless Charging Covers
Upgrading SSL software.
“As a country, we are having a great national conversation and debate about exactly how to manage privacy concerns,” Rice says about her new position. “I look forward to helping Dropbox navigate it.”

When dealing with pretty much any national level politican closely associated with the executive branch of either the current administration or the previous one it is really easy to read this in a cartoon "evil villain" voice with an implied ellipsis and malicious sarcasm on the "...navigate it" part.

Ouch.
I believe if you use a new private key but sign the same CSR the dates will not change. Ideally the old certs should be revoked which should provide some info on this. I saw this explanation on the discussion of the herokuapp.com's cert's dates not changing.
Ask HN: Was the free 1st episode of Silicon Valley an elaborate Googlebomb?
I was looking for a way to watch ep2+ of Silicon Valley and I realized that most searches I would normally use to find places to watch it led to an interminable amount of blog posts and news stories about SV episode 1 being available on youtube. If they didn't intend to wipe out all links to pirate sites then it's a hell of a bonus.
I've eated cheaply in southern Vietnam - things like pho (noodle soup) and rice paper rolls which aren't fried. People there are pretty knowledgeable about the freshness of food - if a stall serves up crap, they go out of business pretty quickly.
I have a problem with this notion: they are being tried in the court of public opinion as we speak, the prosecution has made its case, the media has disseminated theirs, and you expect Tesla to take the high road and plead the fifth?
How tell if an Accelerator is Right for You
> So bad news: it's hard. good news: people are trying.

More bad news: They're failing pretty hard. CACert have been around for a long time, and still haven't managed to get themselves audited.
I wish there was (or maybe there is) a protocol for updating your password. Then managers like lastpass and 1Password could more easily update your password. Maybe, behind the scenes they could rotate your password every x days automatically. Having a protocol in place would also make breach notices an easy "update all passwords" click away.

There's probably a reason this is a bad idea. Let's hear it! :)
The separate Messaging app currently has stickers, I don't see why they'd remove them.

And yes, the Pusheen emoticons are the best.
Show HN: simple chrome extension to auto-renew cafe wifi sessions
Actually, quite the opposite. I told them that they wouldn't have to do shit unless I established traction for the idea first (as I mentioned in the post).

Tough to do a TLDR version for everyone else without reading it yourself.
I'll reach out to you.
Good point actually. They would be higher one way or another. Labor is the major expense in repair and it is billed by the hour. Hmmmm....
It always drove me nuts that on Android, the main and Messenger app had the same APK size -- it made you wonder whether they had the same APK with a different activity set as the start activity.
Reverse Heartbleed: Test for vulnerable clients
If you uninstall the Facebook app, their Messenger app works just fine standalone.

Android: https://play.google.com/store/apps/details?id=com.facebook.o...

iOS: https://itunes.apple.com/us/app/facebook-messenger/id4546384...

Windows Phone: http://www.windowsphone.com/en-ca/store/app/messenger/3219d3...
Industry Group Aims to Change Bitcoin Symbol to ‘Ƀ’
The Feds Cut a Deal on In-Flight Wi-Fi, now Privacy Groups Are Worried
We just pushed out a tester (we wanted it for ourselves and decided to make it available to others): https://reverseheartbleed.com/

Thanks to @patio11 and others for point out the 'other half' of this vulnerability and motivating us to get a quick fix out.
Thanks for the quote. You read better than I, clearly.
Another one to consider using is the no-frills option of Password Safe. It's designed by the man himself, Bruce Schneier.

http://passwordsafe.sourceforge.net/
Say Something Nice About Delaware
Google Patches 31 Google Chrome Security Flaws
Serendip-o-matic – Connects your sources to libraries, museums and archives
It discourages two-factor auth for password change requests (such as site username and access to your email account), it adds an additional point of failure, and it would make it easier for attackers to lock you out of your account once they gain entry.

Plus, if any changes are to be made to the authentication process it should be migrating to two-factor auth across all services.
Woah! This looks really really nice. I'm definitely going to re-visit it when I get back working on my start-up :D
Well, the timing of opening/closing of doors might be able to give you a radius from work to home. But since most repair shops know this to bill you, thats mute. If it logged when, then they would know your routine, but they could guess that anyways. Yeah, it's a bit paranoid, and logging it is less harmful than real time updating and tracking. Still, some of the guys that my dad worked with would not by ANY means be considered trustworthy people.
TACK looks cool. I read through the RFC and have some questions ....

At first I thought an active MITM could drop TACK negotiation from ClientHello and wait 30 days until pins expire, but as I read it, I think that should result in a "contradicted" pin.

You could do browser profiling though, and only MITM clients which don't send a TackExtension in the ClientHello, or behaviourally look like IE, say. I wonder if it would have been better not to indicate that client supports TACK? (Maybe constraints not obvious to me).

The other thing I'm not sure about is overlapping TACK handling. I don't see what's to prevent an MITM from adding an additional new TACK of their own in the ServerHello, gradually superseding the "valid" TACK. That would take like 60-90 days though.

This looks like a massive improvement, although I wonder if it actually protects clients which do not support the extension?
Data Infrastructure Engineer  LaunchHub
Join LaunchHub as a Data Infrastructure Engineer. We’re LaunchHub, and we’re working to change how companies utilize data for mobile apps. You might know our founding team from popular social and mobile games that scaled to 80M monthly active unique users, an $80M annual revenue run rate and was the #1 Top grossing app in iOS and Android.

We are a team of engineers and product people. We are extremely user focused and we build applications that allow people to create better products and help with business performance.

Founded in 2013, LaunchHub already has early traction and a pipeline from large mobile customers. We’re backed by First Round Capital, SV Angels and other prominent angel investors.

We’re poised to make a huge change in the world of Big Data, and we’re hiring.

To learn more and to apply, go to: http://www.thesourcery.com/jobs/705
The FDR data will still tell them whether it flew (ie pilot commanded) into the water or crashed (ie ran out of fuel or suffered engine failure), whether it had been on autopilot, whether there was an earlier fire that knocked out communication and navigation etc.

There are plenty of events where the CVR provided no useful information and the cause of the crash was determined by the FDR.
I see TACK as a decisive mitigation for the biggest danger posed by CAs today (that they enable global passive adversaries to conduct dragnet surveillance), and as a step towards a workable web-of-CAs system.

I do not believe in pure peer-to-peer schemes as workable solutions, but I do believe that we could in 5 years have a system where I can trust ACLU first, and then Verisign as a fallback.
Ask HN: What did you do when you clashed with your parents?
I made a new account to ask this question: If you left your home before or during high school due to clashes with your parents - how did that experience effect you? Do you regret it? Any advice?
Show HN: I made an app to track video topics daily
It's called Dipper, and it's free. Like Pulse, but for video. Works well for sports highlights, TV shows, Bitcoin, Elon Musk, Neil Tyson... Whaddya think?

https://itunes.apple.com/us/app/dipper-personal-video/id854572485
For some reason, Elon Musk has a reality distortion field that works. Most people don't.

As start-up advice, I would say you don't have a reality distortion field. If you try arguing with a customer in public, you are very likely to lose, even if you are right on all the facts.

How Musk pulls this off is something I still don't understand, but don't think you can replicate it.
Except in this case, an extra 'return 0' would just mean ignoring the heartbeat message completely. It's a slightly different situation from Apple's bug.
Once you are doing functional programming a bunch of classes of problems including a bunch of classes of security problems go away.

For example, here, if the guarantee of functional programming is that a given input leads to a given output and has no memory side effects, then your attack surface area is a lot, lot smaller.
thanks. the answer is yes. otherwise I wouldn't feel I had much to share. I've been a/b testing on myself, in series, for awhile.
I would much rather trust a handful of multinational corporations than a group of "local geeks" to tell me which keys I should trust.

Why?

1) It is probably easier for casual attackers to trick a local geek to trust a phony key. Determined attackers and state-level actors can probably compromise CAs as well, but most day-to-day threats are of the casual type.

2) When a local geek accidentally trusts a phony key, and other people realize it and point it out to them, all that happens is "Oops, I'm sorry." When Comodo is caught issuing phony certificates, there will be a Silicon Valley-wide uproar, browser vendors will very quickly invalidate the offending intermediate key, and the incident will hurt Comodo's bottom line for many years afterward. In other words, Comodo is more accountable than any private individual, not because it's any more ethical, nor because it is any more competent, but simply because it is a highly visible target of public scrutiny whose very survival depends on its public image as a trustworthy CA.

3) Most people (including but not limited to grandmas) who are just beginning to use the Internet have no way to know which keys to trust. We in the programmer community are an exception, not the rule. So what's actually going to happen is that browsers will trust, by default, a bunch of highly reputable individuals or groups (perhaps the browser vendors themselves) and advise the user to trust whomever these people trust. That's not really different from the current situation with CAs. We just replace Verisign and Comodo with @cperciva and @tptacek.
I would also love to hear what your product is and how you're succeeding.
now that's some hacker news ingenuity. exactly why I came here. Love it.
Thanks! We're still a while away from the mobile app, but great idea!
excellent suggestions of resources. thank you!
It is an interesting way to go, most people on here would have the code "fully unit tested" with at least the latest in Twitter Bootstrap 3 for the frontend and good ideas on how to scale the thing before showing the product to potential customers/users.

A solid product kind of helps with the success of things and there is always the ever-present risk that a software project will take aeons longer than intended. A software product should be understandable to the target audience within seconds of seeing it. Not having at least a prototype to show (as above, without it being optimised for scaling up) is not really going to make that easy - there is a lot to explain that could be simple to just 'get' with the prototype up and running. So, from the programmer perspective you took a lot of risk!
"The remedy for bad speech is more speech."

I don't always agree with it -- sometimes lawsuits are necessary -- but Tesla is trying to resolve speech with speech.
I agree, coal will be used for heating and electricity and we can't stop that. But if you improve FT we'll also use coal for our cars which just makes things worse!
So will you ever play the startup game again?

Maybe, but in a different way.

or are you focused on climbing the ranks to your tier 1 dream job?

I have no taste for "climbing the ranks". I want to get better at stuff. Corporate dysfunction irritates the hell out of me. It'd be so much better if work was about work and not interpersonal manipulations.

Right now I'm looking to level up on machine learning. I'm on par with your 95th-percentile professional data scientist, but there's a lot that I still don't know.

lastly, is it because you are 'smart as fuck', that why you are so jaded now because the value you brought to the startup would have taken you much further in a traditional job

I spent almost 3 years building the backend for a graph-based, distributed database in Clojure (for a startup). We ended up not getting any clients; that was above my pay grade. (Mistake #1. In a startup, take responsibility for all parts and run from founders who try to go alone.) If we had, though, the stuff I'd built would have made it really cool.

Then I ended up on legacy maintenance at Google. In other words, that 3 years bought me fucking nothing.
It's much more legible than the tiny bars symbol. The bars icon is a bad fit for a wide and short space. The new signal strength icon looks like something that Ive wanted from the beginning:

http://static3.businessinsider.com/image/5011df3deab8ea5e1f0...
Why is it uncalled for to publicize the lawsuit if it is frivolous? In general, it may be bad PR; but if you're willing to file a suit that is public. There is no reason to cede the initiative to the plaintiff if you think they are trying to manipulate you.
We've looked at Mapbox, but decided to go with Google Maps for now. There are some cool things we can do with Google Maps, but it's still an option for the future depending on the direction we decide to go. Thanks for the feedback!
Jesus.

As someone on youtube noted, take a close look at around 0:50. You can see lights flash, which seems very likely to have been from someone unlocking the car. Right after, the door handles miraculously start working again. The whole thing reeks.
CocoonJS 2.0, now ready for HTML5 Apps Introducing the Phonegap Killer
It's great when he is showing how the door handles take about 5 touches before they work. You can clearly see the rear lights flash as someone hits the unlock button right as it magically starts working.
We're going to prove ourselves in this market in the short run, but long term we'd like to branch our into other job markets. We definitely want to add in the transportation options soon.
awesome. that was fast. I love lastpass!!
Take a look a scans.io. They have internet wide https scans every couple weeks.
Correct

The fb app is intrusive (no, I don't want fb notifications on my phone), offers a worse experience than the mobile web version and, well, it's another app

Messenger on the other hand is something much more useful (and lighter)
Ignoring Rice's convictions, I'm really curious as to how a person like her ends up at Dropbox of all places.
This is no job for traditional science; we'll need a whole new kind! Quickly, to the Wolfram-Signal!
If they don't do things so perfectly or well at scale, and then have a "bad attitude" about it, they will likely turn off customers, lose their stellar reputation, and will have less of a problem at scale. The market will provide an excellent feedback loop.
HR advice: Hire for velocity of learning
PKI is the worst form of authentication, except for all the others.

I like to design secure protocols for fun, and they all inevitably converge into a PKI when you start adding the non-trivial required features. It's incredibly frustatring.
Thanks for the tips. I'm new here; would it be a faux-pas to re-post the app URL with the same "Show HN" title?
Ask HN: Anyone tracking statistics on resets for Heartbleed?
It would be interesting to track if user's really care about security. If you run a site which was affected by heartbleed and you sent out an email informing users to change their passwords, it would be interesting in a week, and also a month from now, how many users changed their passwords. Also, if you didn't sent out a disclosure email or were not affected, how many users change their password in this week and this month?
What about if there was a hybrid solution where we all collectively issue certificates in some sort of p2p model. I know there are huge technical hurdles to that and you have to be careful of nefarious parties trying to inject bad certs but at least we would get rid of the monopoly.
Mysterious White Light seen on Mars not from E.T.
If masscan does generate these false positives,

and masscan has been available for 6 months,

and masscan is widely used across the global internet,

then a log going back to January SHOULD have masscan false positives in them before March.

It seems like:

* Either Robert Graham is wrong that masscan can create these log entries (unlikely)

* masscan isn't used widely enough to ambiently generate errors since its release (maybe)

* This operator managed somehow to truncate or alter their log configuration (maybe)

* Some other heretofore unknown TLS scanning tool generates a different false positive (maybe)

* Some heretofore unknown entity knew about Heartbleed and scanned the Internet for it (maybe)

The evil unknown heartbleeder isn't the most likely scenario in this list.
What would be required for "engineers" to form one or more trade guilds with the function of the AMA? (Although frankly you should talk to a few dentists; the AMA's got nothing on the ADA.)
> You are a coward.

That sort of language is definitely not constructive, and probably explains your downvotes.
Blockchain protocols: the Ron Pauls of distributed systems design.

Replacement of DNS with a blockchain protocol is never going to happen. It's hard enough to talk DNS operators out of baking the CA system into DNS, despite the utter inapplicability of DNS to that problem. DNS has a fierce, powerful status quo advantage.

If you believe strongly that blockchains are going to be the future of global networking, a better plan would be to build a system that ignored the DNS and used a blockchain protocol instead. For instance: the DNS doesn't play any role in matching Google search terms to SERPs, nor does it control how AIM matches names to IM accounts, nor does it control how IRC matches nicks to receivers.

Forklifting out giant chunks of the Internet is a bad plan. Deprecate the Internet and build a new layer on top of it. Eventually, TCP/IP will find itself in the same role as Ethernet; it's inevitable.
Yup, if anything more web sites should be doing this.
Can someone give me the stats of success of MOOCS?
Would love if someone would point me to the write links about some coding MOOC statistics as I'm not convinced that these services produce actual quality apps. Thanks
He's not a role model at all. He's not in the original text, and does not appear again in the movie.

It's a talking reality check.
With this, WhatsApp, and Oculus, it seems like Facebook's initiative in 2014 is to split up into more loosely-connected services rather than a single product.
This will not happen.
I guess I should've worded that differently. No, it doesn't force you to handle errors, but it makes the possibility of errors much more obvious. With exception handling, you never know what functions may raise an exception; Go is much more explicit in that sense, so if you don't handle the error, it's your own damn fault.
Agreed. Although in general, I like my error messages terse and to-the-point; for example, I'd definitely prefer "file %s not found." over something like "Sorry, but we regret to inform you that the specified file cannot be found. Please try again."
You should also get some information about the computer through on the email. If someone is on IE8 with an 800x600 monitor then they are a different class of customer to someone running - say - Chrome on Linux. Knowing someone is 'a Mac user' is also a telling signal if you intend to sell them something.

Also time on site is useful to know. Did they read the page? Maybe if they spent a good few minutes with the page open.

IP address - GeoIP to city with country - is also a useful thing to know. Do you really want to respond to that guy where shipping prices mean that a sale is effectively unrealistic?

Such mild-deep-stalking would be helpful to your customers and make your service appeal to a wider audience.
Imagine a pink phone w/ a flowery case and a software ui styled to look like starcraft controls.
I like that. I think by that measure, though, OpenSSL is failing badly. It's like an old rusted-metal and rotten-wood bridge that should have a sign saying, "No vehicles over 2 tons," but instead it's carrying highway traffic.

I'm starting to get frustrated by the security experts basically chasing everyone away from cryptography. Am I the only one getting tired of the experts (many with misaligned incentives) telling us, "This stuff is really hard... Just trust us"?
For what it's worth, we're not retaining any of the data that this tool finds, nor are we able to track this back to the vulnerable services (we're not logging clients' IP address or user agents).

If you can't find a vulnerable site, this one-line works for me as a test case (using a version or Ruby with an old OpenSSL):

require 'faraday'; Faraday.new.get 'https://reverseheartbleed.com/exploit_me/your_url'
Show HN: The Let's Code JavaScript Sampler (please critique)
I've recently put up a page of sample videos for my screencast, Let's Code: Test-Driven JavaScript. I'd love your feedback and critique. The page is here:

http://www.letscodejavascript.com/v3/sampler

(The plan is to link it as the "free" option on the subscribe page, but I haven't done that yet.)

I've talked about my experiences with Let's Code JavaScript here on HN before:

https://news.ycombinator.com/item?id=6433110

https://news.ycombinator.com/item?id=6038226
Yes it 'could' look awful, but it could also look good too. That's where good designers earn their paychecks. As a designer, I sympathize with designers at Apple. Some of them must feel pretty frustrated.
That would be in conflict with a freemium model. People would make a client that ties together dozens of free accounts.