skysight-inc/HackerNews huggingface dataset:
The business account comes with unlimited history of deleted/modified files, so you can recover anything that once was on Dropbox.

On my Macbook Pro, the "average battery impact" (last 8 hours) as reported by Activity Monitor is 1.2 (not sure what's the unit, but it's a low value compared to other apps), and we use it daily for work so it's kind of active the whole day. I wouldn't call it a CPU hog by far.
Here is my theory:

Most likely this huge investment is a way for investors to get their money from their previous investment, which might be locked up due to some contract rules.

Basically, in order to free their funds (or avoid taxation) from their first investment (let's say from some portfolio company of Benchmark/or other participated investors), they will transfer funds from the big company to the small company aka Quora (in which these investors got a better contract).

I am not going to be surprised if Quora gets acquired from the bigger company, which happens to have the same investors ;)
LibTomCrypt – a portable cryptographic toolkit
Initial thoughts from trying it out, I do think its great so far:

- there are some unfortunate missing capabilities (no way to remove conversations)

- got into a stuck spot where I had to force-quit the app (edit: found cause; it was because the 'Share' view's X was not tappable while being on a call.)

- i'm not entirely sure how the auto-import feature will work with how I have dropbox.app already auto-importing... I did a test and I don't have duplicates, but which app is doing it now?

- on ios, this is totally going after the ios photostream, which is fine for me. I do use the photostream with people for shared albums, but this might be more open and customizable if you could remove stuff or make 'albums'. I guess i'd like a way to make standalone ways to share without having the whole conversation paradigm tagged on (which is good for a lot situations, but not all I'd be looking for)

- no raw as expected, but i thought i'd complain again

- the horizontal bar for scrolling date ranges coupled with the standard vertical grid of photos is fantastic.

- Also, what is the point of "hidden" — this one seems like a big curveball. Dropbox/Carousel is like 'your own stuff' so why would you need to hide something; I just don't understand the use case — maybe like you're browsing photos with someone else and you wouldn't want them to see some special photo, but don't want it deleted?

- Swipe down to hide I think is too high of a UI for hiding photos ... If I swipe up to share, I instinctually swipe down to not share and 'get out' of the photo view... I'm glad there's a catch for 'are you sure' but I really would prefer to have it be not that accessible. I don't have a huge need for hiding (as I don't even entirely get it as I mentioned above) so I'm not digging how big it is in the UI
Use Bower for managing front-end assets in Rails
>>> let = lambda
File "<stdin>", line 1
let = lambda
^
SyntaxError: invalid syntax

Am I misunderstanding you?
Great tech people often make mediocre or bad investments, or invest in things that are not really worth their time in the end. Things like, Max Levchin creating slide.

It's just that the amounts being available to invest are so staggering in SV compared to other places, that any movement of money will look huge in comparison. That makes news like this sound infuriatingly irrational. Also, i guess the facebook link is important.
Fun fact, ICBMs do astronav! They have on-board cameras and computers to take a star sight and fix their location.

In the war they're designed to operate in GPS would have been disabled long ago.
Corrected. Oops.
True, but is very likely a correct one.
I'm of the same opinion. I host all of my production apps on Linode (the 8 cores is nice too), and my staging environment is on DO. I don't mind paying more for Linode because I think their network is better.
Finally they have a free trial available

Previously if you had to develop against Dropbox business features like SSO you had to shell out $$$
In fact, this business offering is a 44% price increase compared to the previous Dropbox Team offer (which used to be $125/user/year), for a slightly smaller feature set.
If your DNS is compromised SSL and x509 is currently what's protecting your users from a fraudulent site.
Well, it's typing-friendly but not (re)learning-friendly. I guess it depends how you weigh those concerns.
My understanding has it one issue is that a lot of the control-system benefits of the tiny quadcopter go away when you scale up and the blades have actual mass (so changing their speed is hard).
http://privatekeycheck.com/perhaps/
I have a buddy who released something similar to this a little over a year ago called "The Carousel" (https://itunes.apple.com/us/app/carousel-slide-projector-for...). It's complete with the old slide projector sounds and slide replacement animations (iirc). It sources the gallery images from Instagram.

While being a standalone ipad gallery app, it can also be tethered with apple TV to make your ipad act as the slide projector by mock-projecting the gallery on your TV.
Stack is traditionally accessible too. So you mean global/static memory? What languages would let you edit that? Can you get a pointer to it in C and change things, or is it stored in protected memory blocks with the program text?

You seem to suggest that the snapshot of the heap gets not just freed sections of the heap but the whole heap? If so then my other idea is invalidated (allocate on the heap a chunk of memory large enough for the keys and never free it, just re-use it when needed).
I think the author is proposing to replace CAs with PGP-like web of trust but keep the rest of SSL/TLS the same, so public key crypto would only be used to setup a session key.
Better link: https://en.wikipedia.org/wiki/Chip_log
Blocked in Canada
http://watsi.org
StandDesk – the world's most affordable sit-to-stand desk
Shouldn't this post be titled: Most StartSSL certs will stay compromised because their customers are too cheap to pay to fix them?
> Big Bang Theory isn't made for geeks; it's made for people who want to laugh at geeks.

It's important to note that BBT's jokes are largely predicated on academia and NOT tech culture since their inside consultant is a physics prof. It's amusing when the "geeks" complain how the show portrays them, when they don't just get the humor having never shared the experiences of the academics on the show.

That said, the volume of nuanced yet poignant physics jokes has dropped since season 1. Still not bad though, and enjoyed by those without the misplaced egos.
Short answer: GHC is not just a compiler; it's also a rather large library.
To be fair, sama listed "It's not about the money" as SV lie #1:

https://twitter.com/sama/status/453708825250381824
So Granny huffs and puffs and calls me, trusts my key through the sexy new UI I talked about and is done with it.

I specifically said that PGP may not be the solution, but what we have now is just ridiculous if you really think about it. We have no choice but to trust 4 companies on precisely nothing but their word. Even if you mistrust their word - and I do - there is no alternative choice.

Security always boils down to trust in the end, and the status quo outsources it. It is the definition of stupid.
Google Enters Hotel-Booking Business
Thats what really gets me about this, either this is truly a fucked up situation or something isn't getting through - if you're in the valley and you can write a jquery selector/do a few frontend customizations, you can put your resume on dice and have 10 phone calls the first week. I don't really know what to say, I have no degree but have just a few contacts and taking a job at a company like that for less than I'd get at an in-n-out seems way out of line.

Suggestion to OP: post your resume on a few sites and get recruiters calling if you haven't. Maybe put your teaching job on the bottom and emphasize coding ability. There's no reason you shouldn't be getting a few interviews very quickly unless you only speak in Klingon irl.
I posted the same thing above but you can use https://marketplace.atlassian.com/plugins/com.atlassian.plug... to work around this.
Thank you! That book has been an amazing resource. One of the few ones I still got in a dead tree format.
English sorry and please are wildcards and they got diluted to extent that non-native english speaking countries use it for a light form of an apology.

I agree that constantly repeating please is a bad UX instead of "Thank you for shopping...." it could display "Thanks. Have a nice day!"
Considering the current ssl certificate renewing/revoking bender everyone is on (and the troubles they're having and the costs they're incurring), this is a very important point.

If it's true, then everyone is wasting a lot of time (time that should be spent mitigating other, more serious risks).
The fact that two of the largest sites Facebook and Twitter use it is good enough for me. All the young ladies I've spoken to don't seem to mind infinite scrolling either.
Very nice.

If you make the generator always return a string, then you can make it print, thus:

print '\n'.join((not x % 3) * 'Fizz' + (not x % 5) * 'Buzz' or str(x) for x in range(1, 101))
I explained (1) poorly. And yeah, I do agree that they feed into each other. Companies and orgs collectively create supply and demand, and people's attitudes have impact on that.

What I meant was there are fewer designers on staff because there's a need for them, but a much lower need for designer man-hours than coder man-hours.

Your average web/software startup can be served by one or two designers while the coding team scales up to 10+ times that number. Maybe that's different in video games or other design-heavy areas but consumer and business products don't seem to have as much demand for designers.

Designers work tends to be in much more of a winner-take-all star system, where a celebrity with a track record like Johnny Ives, Karim Rashid, or Phillipe Starck can make millions, while your 'average' designer makes very little. In contrast, it's probably a flatter distribution for software engineers.
I am interested in making more money than a single person could ever comfortably spend in 10 lifetimes.
Could your language affect your ability to save money?
A reasonable objection, but I don't see that it applies to OverloadedLists either directly or by analogy (though I could totally be missing something).
>>> let = lambda x: 2*x

>>> print let(4)

8

Edit: Awesome, downvoted for helping.
Atoms and keysets both have pretty much the same caching semantics, though: they get repeated over the wire with pretty good locality, and don't have conflicting terms busting the cache in-between. That's not really true for anything else, which makes me guess that an arbitrary term-branch cache would be pretty useless.
I propose a game. Here are the rules.

Private key comes (as a surprise) in many forms, including:

1) base64 encoded version

2) decoded version

3) "rocket science" parts (n, p, d, ...): openssl rsa -text -in ./private.key | grep "^[a-z].*:$"
-> modulus:, privateExponent:, prime1:, prime2:, exponent1:, exponent2:, coefficient:

You may assess the leak potential by yourself:

a) by writing down your private key secrets (openssl rsa -text -in ./private.key) on a paper or in a python keyhunt.py and heartbleeding a real server (initialized with a known private key) few times and then inspecting the output (requires a bit of patience) [X]

b) by running openssl in a debugger and understanding what happens with the crypto secrets in a real live run (requires a bit of reversing) [X]

c) by running the openssl under e.g. valgrind and checking how the allocation of different forms of the crypto secrets really works (requires tools) [X]

d) by modifying the openssl CRYPTO_malloc() code to initialize crypto buffers with a recognizable patterns and then heartbleeding your test server (requires a bit of coding) [X]

e) reading the code and seeing how all those intermediate forms of the private key are handled (and reading it again, and again until you are certain of your conclusion) (requires skill) [X]

f) by reading from the web accounts and results of people who have seen the private keys (requires trust) [X]

g..z) by something else ... [X]

Then post your how many X's you had to go through before you see the leak. Good luck! :D

I didn't get far before it was seeing the leak time for me, but then I cheated and saw most of those done anyway, was painful but fun. :)
> I find a lot of HBO (and other cable) shows start slow and improve once they find a rhythm. Perhaps because they don't need to immediately grab an audience.

I find that's true of most shows, including those on traditional networks. I don't think its really a cable (or premium cable) vs. traditional network issue.
Not enough factories in the java-ic python...
That's fair. I re-read the article and see your point. I would still agree with other comments here that a WoT would be difficult to implement in a user friendly way that wouldn't also be exploited.
Mine with some itertools abuse :)

from itertools import cycle , izip

[(f + b or x) for f, b, x in izip(cycle([''] * 2 + ['Fizz']), cycle([''] * 4 + ['Buzz']), range(1, 100))]

Edit: not sure how to post code in comments. e.g. * is lost
If you are subtly pointing fingers, please point at "big company" and not the VC. They are the ones offering that engineer X today and 100X in the case of an acquisition.
Question - would you recommend working through SICP in Racket? What about MIT Scheme in Emacs?
Ask HN: As a web developer, should I learn mobile development?
I'm a student with a year of web development experience (Rails/PHP).

I've been thinking about learning mobile development in order to jump on the mobile bandwagon.
Maybe even taking 4 months off school, take a mobile development bootcamp and pursue other interests as well.

Do you think it would be worth it?
Or should I not bother and simply specialize in web jobs?

Would love to hear your thoughts.

Thanks!
Actually, this is very useful message for me. I can google the error and fix the problem on the spot.

Desktop software trained people to parse it.
Do it professional and straight up. See this clip from Moneyball: http://www.youtube.com/watch?v=jXEtOPMW2hM
Can you elaborate? Perhaps you are talking about the Char8 ByteString instance? It was a mistake to declare that instance, I think.
Exactly. They are not unbiased.

They are awful with cars. If it's a Honda or Toyota, it's awesome, period. They'll list negatives like "road noise" or poor OEM tire choices.

I own two Hondas, one a 2006 Odyssey minivan -- it's a decent car. If you know anyone who owns a 2005-2010 model of this car, ask them about trouble with the sliding power door. I betcha 5/10 times, they'll start spewing about a ridiculous $500-800 repair to replace a broken door hinge, because of a defective $0.50 plastic wheel that breaks.

When I read my CR review back in 2009/2010, not a single mention of this issue.
And then use your browser's certificate inspector to check the issue date of the certificate. If it's earlier than April 7, 2014, it's still insecure.
> Buffer bugs in C don't come from the language, they come from the tendency of C programmers to value performance highly.

You have to use other people's code / language constructs which are underspecified and/or you don't have time to fully understand. Throw in versioning to the equation and now the problem is exponentially worse. This is why C code will always be full of memory vulns. Heartbleed is a very oversimplified example of the problems in C.
> And fundamentally you have to trust that they who hold the Queens aren’t dishing out copies of your certificates.

In general, I'm a fan of analogy, but I'm having trouble following this whole queen/princess/baby thing. Putting that aside, I think you're claiming that CAs can present your certs to random clients?

This might be an indictment against the DNS system, which directs the clients to an IP address of its choosing, but if the client makes it to your server, your server chooses which cert to present to the client.

> What we have done here is fitted our doors with some mega heavy duty locks, and given the master keys to a loyal little dog.

Again with the strained analogy. Who's the dog? What does the mega lock represent?

I think this belies a fundamental misunderstanding of what the CA is doing. The client asks your service to validate itself, your service does so by saying that Verisign/Thawte/etc. has previously signed the cert that your service sent to the client. The client does not have to automatically trust Verisign or Thawte or whomever you say signed it, and furthermore, if it decides that it does trust that party, the NSA is not able to use that to its advantage in any way as a result of Heartbleed.

> As of today, that green padlock no longer means what it once did. And the reason for that is because of the business conditions of gatekeepers.

No, it doesn't mean what it did yesterday because of a bug in an implementation of OpenSSL. The protocol is still just as valid. The business conditions of the gatekeepers, while distasteful to you, doesn't invalidate the mechanisms by which that little green padlock gained its fame.
My for-real-not-humor implementation:

def fizzbuzz(i, n):
while i <= n:
yield i%15 and (i%5 and (i%3 and i or 'fizz') or 'buzz') or 'fizzbuzz'
i += 1

for x in fizzbuzz(1, 100):
print x
Not only that, for many engineers they are actually going to be "changing the world" at a larger company with huge resources and scale to give them. It's just a different mindset, not better or worse. I wish we weren't so judgmental either way.
This is more of a problem with the simplistic trust model that is typically used with X.509 and TLS, rather than a problem with StartSSL. The type of security that you are suggesting is similar to opportunistic encryption or decentralized trust. Self-signed certificates are intended to fill this role, however, it is too difficult for the average user to use self-signed certificates securely, so browsers put up a scary warning to protect users from themselves. If cryptographic concepts could be securely exposed to end-users, then self-signed certificates could be used securely. In that case, StartSSL wouldn't even need to exist. Unfortunately in the current trust model that is being used, StartSSL has to exist to fill the niche for people who just want SSL to work. But because of recent events, this creates a problem in which the all-or-nothing security model essentially requires that StartSSL be blacklisted because of their business model.
It's been a long time since I played it, so I don't know how it holds up, but there's Empire of the Ants.[1]

It's more combat-oriented than something like SimAnt, but you still have to manage things like food, construction of your anthill, etc.

[1]: https://en.wikipedia.org/wiki/Empire_of_the_Ants_(video_game...
How does a Linode instance stack up against an AWS instance in computing power?
I have something on AWS which pushes a c3.large instance to around 80 percent of CPU util. I am thinking of going with a different provider for that server at least, if it makes sense cost wise.
You have a choice. Remove all CAs from your browser, and manually verify all the server signatures yourself.
The old de-facto formula was to estimate the number of hours then multiply times two.

Basically, break it into pieces. Usually individual pages and estimate each based on prior experience. Add to it other things you may need to do like designing a schema, interfacing with other APIs, etc. This will probably give you your best case scenario. Then multiply times two because stuff always comes up that you didn't think about. This is what I use for "ballpark" estimates.

This is definately open to optimization.

I think it is important to understand "both sides". Clients usually like fixed-bid or per project pricing because it limits their risk. That way they won't be surprised by a huge bill.

As a freelance developer, I disklike fixed bids because it requires me to manage scope really carefully, otherwise my effective rate falls really quickly. So this really means that I need to increase my bid by some amount (I do 25%) do limit my exposure. So this isn't quite as good for the client as it might look on the surface.

A better way to do it is a lesser rate, such as hourly or weekly, and then break the work into iterations or phases, each resulting in something demonstrable so they can see what they are getting for their money. After they pay for the phase, they can walk with the source code written so far if they want. This limits risk on both sides. I've gotten paid for what I've done so far, and they have something tangible for what they've paid so far.

I start out with prototypes/proofs of concept to explore the most risky aspects of the application first and then feed what I find back into the estimate. This way, I can the client can know sooner than later about gotchas that can affect schedule or cost.
It works well enough for the servicestack people.
Comodo PositiveSSL for $9 / year and $99 for wildcard.

Multi-domain (100 domains or subdomains) for $30.

https://www.namecheap.com/security/ssl-certificates/comodo.a...
Slashdot is Port Scanning Its Users
DigitalOcean is doing this since the beginnning.
Calls who? Why should Granny trust you? What you described is no different, Granny is still outsourcing her trust to some 3rd party.

Or are we working under the assumption that every Granny has a grandson who is just as technically competent as you are? The fact of the matter is, PGP has just enough friction that if implemented correctly, will still lead to the vast majority of non-technical users simply signing up to some SaaS to handle it for them, and with that you end up in square one, where a handful of SaaS providers are the gatekeepers to everyones identity.
We pay for Google Apps for everyone in our company, and unfortunately no one used Google Apps. I know some people pay and expense Dropbox on their personal accounts, and if more of our team needed to use Dropbox I can easily see getting on their Business plan. Plus the Business plan ends up costing less than the consumer version.

The couple of thousand dollars is fairly trivial amount of money - you need to look at price per headcount. Salesforce and other SAAS services that we use cost a lot more per person and yet we still happily pay for them. I can also see a simple feature like 'Track logins, devices, and locations	' being a must have depending on the security requirements internally.
If written by a Canadian, yes they should.