skysight-inc/HackerNews huggingface dataset:
Reality is NSA has to do very very little to make this happen. Tiny nudges here and there. Profit motive encourages people to move towards complexity. Simple software commodifies too quickly.
This line made me go between it and inspecting the ssl3_record_st structure carefully, since the way it was written looked like a flexible array member:

unsigned char *p = &s->s3->rrec.data[0], *pl;

I think it would be better written as:

unsigned char *p = s->s3->rrec.data, *pl;

to make it clearer that data is a pointer within the structure.
Isn't that dirt cheap for a trip to Mars? Like, much lower than NASA missions to the moon?
Ask HN: Review my startup: JobKaster Google Maps for Jobs
Hey guys / gals, after validating the idea of using the Google Maps API to search for jobs and a successful beta, we've relaunched - implementing much of the feedback and comments from both the HN and Reddit communities. Plus, we've got an all new design which I couldn't be more excited about!

Would love to get some feedback from you guys. What do you love? What do you hate? Any WTF's?

Currently we're focused on service type jobs and food service as these types of jobs are most dependent on location, but we'll branch out soon.

Thanks for your support!

The site can be found here: www.jobkaster.com

Regards,

Paul Chittenden
Co-Founder
JobKaster

paul@jobkaster.com
OKCupid CEO Apologizes for Supporting Antigay Candidate
See the footnote in the article:

"An exception may be if your site provides specific functionality such as in a drawing application. Even in this case it is best to provide shortcuts as an option the user has to turn on rather than one that is on by default."
It is always good to reference SVMs (http://en.wikipedia.org/wiki/Support_vector_machine) when talking about neural networks.

The advantage of SVMs is that after re-mapping the data so it becomes separable, they also guarantee to separate it as clear as possible.

Not sure if they can solve all the type of problems as well but in some cases it is considered a better, more analytic approach.
Many people believe Gamification is the key to the problem of motivation. But only in a few cases it could be applied successfully up till today. Posting the same post 5 years ago might have resulted in a lot of positive discussion and feedback, but nowadays people are already a little disappointed of how Gamification performs in general. It's still a good argument but it shouldn't be the only one and it should have some examples from successful applications by the author.

The same goes for the software that 26gems plans to implement. Gamification should not be its main selling point, but it can be an awesome finishing.
>I'm not asserting that there are no harmful chemicals at all in the food supply

Good enough. We can stop there. This is a discussion about Soylent and its potential benefits/risks. That it seeks to avoid chemical additives is one potential benefit that I posited in the comment that spawned this fork. This is the only reason the word "chemical" entered the discussion.

In all honesty, I am not really interested in enumerating a list of problematic food additives. Perhaps you'd like to post another submission?
How Uber and Airbnb Resurrect ‘Dead Capital’
NoScript with whitelist works well enough.
This is an inherent problem with web apps, since they're an app within an app. There are two different contexts fighting each other. Who's to say that Ctrl+S should save the app state or the page? Whatever we choose as the default, the non-default scenario would feel awkward when we need it.

I can think of two ways to solve this: (1) decouple apps from the browser frame or (2) use a special modifier key for app shortcuts (perhaps re-use the Windows key, e.g. Win+Ctrl+S).
Yeah. From a usability point of view, I think it's important to hijack some shortcuts, but only those who are not commonly used for such as the one mentioned in the article. I would also argue that this behaviour of blogger is not what users expect, hence it is not a bad behaviour. Wasn't there a pair of shortcuts commomly used for this purpose, Ctrl-K / Ctrl-J if i'm not mistaken?
If you visit your own link and then click on the "info" link at the top, you'll be taken to a G+ post explaining that the three.js periodic table demo was an attempt to recreate something the author had seen.

Written in famo.us.
Big examples would be PgUp and PgDn in Google+, and (at least on the old design), F5 on Twitter.
There is a difference between complex and complicated. Crypto is a complex issue, with some subtleties that elude too many people. Low-level crypto, like this, has many small little details (such as allocating and deallocating buffers) that make it very complicated.

You are right: it could be much simpler.
it sure is annoying, and let's not mention blogger's hyper-dependencies on javascript in order to display the page. No javascript, no content

anyway, well what can be done is
- prompt for user agreement to allow these shortcuts, then save it as user preference / cookie / etc..
you could also probably go a little further for the core of the library and use the SPARK subset of Ada. It is almost like it was made for the purpose http://www.adacore.com/sparkpro/language-toolset
http://en.wikipedia.org/wiki/SPARK_(programming_language)
Show HN: Interactive and Generative Impressionist Paintings
Here's a little experiment of mine which produces an Impressionist-style painting from a photo within a few seconds. Pics and tech details:
https://medium.com/p/afa98ccb97da

The experiment itself:

http://mattdesl.github.io/impressionist/app/
“Entrepreneurs just guess – and if they succeed, they say that they had data”
PS Vita Borderlands 2 pack announced
It's lower than market prices for building and launching a satellite to low-earth orbit.
The answer to (2) is Yes regardless of what is the answer to qestion (1).
You're right, that's interesting.
Tellingly, the argument in the text amounts to a strong appeal to the classical humanities as a premise rather than supporting it against alternatives. I'm thinking we should all learn logic and critical thinking whether we major in English or not. Luckily, those other paths exists.
A lot of the python books are really old. Versions of projects have moved on
Wacko in the Morning – with Wacko Bob &amp; more 04/09 by The Wacko Network
https://fedoraproject.org/wiki/Releases/21/ChangeSet#System-...
Has anyone gone in an plugged this into the Quake III / IOQuake 3 source and see if it's make a difference? Speed or better looking geometry?
This is just the result of transitioning HTML to an applications framework. Now the application you use to view articles is not your browser, but Blogger (or WP etc).
The 'many eyes' hypothesis has now been empirically tested.
You know as well as I do that LGPL is not always an option. A very visible case is console games.

But yes, let's go back to lamenting the state of crypto libraries, we can at least agree on that.
Does this article cover anything that the previous ten articles over the past two weeks have missed? Just curious...
The failure mode with this approach is that it disallows coaching.

There may be some bug in a library that's similar to what I do for my day job, and I spot it immediately. Or perhaps I've seen the inevitable results of certain design decisions play out in multiple organizations.

I may not have time to code up a patch. Frankly, I've got about 5 projects on the go besides work and kids.

So, FOSS projects may lose out on that kind of expertise that could easily be crowd-sourced if it didn't ask so much of contributors.
With support for databases not supporting enums.
Standards are important. For all practical purposes OpenSSL has become a standard.

TCP can be exploited, it doesn't mean we ditch TCP for another differently exploitable solution.

I see your point but I don't think of OpenSSL as monoculture the same way that Windows or OSX are.
Over at the Wine project, we forbid contributions from anyone known to have looked at Windows source code or even done significant "white box" reverse-engineering (decompiling, etc). The intellectual property law landscape is far too frightening to be worth the risk of allowing contributions from "tainted" individuals.
YouTube Downloader – Software to download and convert YouTube video
A Designers Guide to Ghost Theming
Yep, and since the invention of guided missiles that could just as easily destroy the bridges and tunnels the explosives have become redundant, too expensive, and not worth the safety risk.
Client: "I'd like to be able to do more graphic design myself, but I use Ubuntu on my laptop. Any recommendations?"

Me: "GIMP"

Client: "I'm not prepared to be spoken to like that"

click
There is no proof in either direction. It's safer to just say nothing at all.
Sounds complicated. Let's just build an AI that can program, and trust it when it says it's not spying on us.
Even when Java fails at runtime, because it forces garbage collection for memory management, buffer overflows and dangling pointers can't really happen - yes, if you're not careful, the process can still have unexpected behavior, or it might crash. Actually, the Heartbleed bug wouldn't have been such an issue if OpenSSL wouldn't use its own wrapper around malloc/free (at the very least, the malloc/free underneath would be a variable in that equation), e.g. http://article.gmane.org/gmane.os.openbsd.misc/211963

So while I love strong and static type systems, the issue at play here is memory safety - the very reason for why people still use C/C++ is the same reason for why Heartbleed happened.
This still would allow side channel attacks on cpu utilization. cpu utilization can be inferred, for example if the attacker has a vm on the same machine, or the attacker can make a second request which completes sooner if the cpu is less utilized.
10kLOC of Haskell for a filesystem seems like an awful lot, especially when considering how much more concise and higher-level Haskell is supposed to be compared to languages like C. Maybe filesystem code just don't fit too well into the functional paradigm?
Jobs recovery killing entrepreneurial spirit
If nothing else it's an indictment of the weird beta-but-not-really-beta that famo.us has spent so much time in, given that this isn't the first time I've seen people assume that it was a three.js demo that inspired the famo.us demo, rather than the other way around.
(2) That was attempted (sort of)[1] and it failed pretty badly due to poor browser support and lack of understanding amongst users.

[1] http://en.wikipedia.org/wiki/Access_key
Two important things to know:

1. Clicking on the OP will force you to watch an obnoxiously, unskippable loud ad about razors and chest-shaving.

2. Sorry, don't think supporting an antigay candidate and a specific antigay law are the same thing. If I voted for Obama because I liked his proposals on health-care, does that mean I also support his wanton drone attacks? If I voted for Mitt Romney because of his tax proposals, does that mean I support...well, his likely use of wanton drone attacks? Now, supporting a candidate specifically for that measure...such as healthcare or tax proposals, that'a s different situation.

But the kicker is this: OKCupid's CEO apologized. I guess to some, that makes him a total flip-flopping hypocrite. With Eich, we have someone who made a donation 6+ years ago and has never sought to give context to it or explain it or give further reflection to it, which means he either holds those anti-gay marriage views just as strongly today, or believes that apologies, or evolving viewpoints is a sign of weakness. Not really strong signs of confidence in a CEO, quite frankly.

(note: I don't think he gets the benefit of the doubt of, "Well, he just doesn't want the government to be in the business of regulating marriage." If that were the case, then why hasn't he simply said that, as other political candidates have done?)

To put it another way: I've worked with people who had less-than-favorable views of Asians, mostly because they had never worked/seen one in real-life (such is small town Midwest). That's OK with me. But if, after working with me, befriending me, and such, they still unapologetically held those opinions? Yeah, that's a different ballpark than simply having a disagreeable belief at some point in the past.
There is no link to your homepage on your blog, both the logo and the "Home" link only go through your blog!
Congratulations. Once I have a charity donation budget again I know where I'll be contributing (along with Watsi...)
org-mode is not there so it's not a good list :)
Both, as they provide the bulk of the code. It would be more illuminating to examine where the unpaid volunteers contribute. My guess would be device drivers, but I don't know.
Well, programming and coding education is already gamified (codeschool, treehouse) so if gamification works for that target audience it will work at the education stage, too.
Can someone tell me how headset manufacturers will differ from any other display manufacturers? Won't VR content eventually standardize to work across different headsets to reach the broadest audience?
How can you make such a claim? Do you have any proof that they were involved with this specific bug?

I get that the NSA is after us but when you consider that the bug is of the exact same class as a bug every C programmer has ever made in their career, it seems probable that it could have happened on accident. Where do you see the malicious intent?
Robert frost gave a good explanation why it is so on Quora.

http://www.quora.com/Robert-Frost-Quora-user/What-are-Robert...
FasterEFT Practitioners Training
FasterEFT Practitioners Training
faster-eft.org

In FasterEFT Practitioners Training You will save $1000 or more by starting with my system because you will be coming back here for really powerful skills.
It's because the people who know the least are usually the loudest, most "arrogtant" and most opinionated people in a set.

It's just humanity; it doesn't just plague the IT community. :-)
For most uses, you don't really have to get them right, though. The problem is knowing when yes, you absolutely do need to get this right.

The cost in effort is highly non-linear. It may be fairly straightforward to get the 80% solution. I agree that it's a problem when devs bring their home-grown 80% solutions to the table when you need a 99% solution.

I make games. No one dies if there's a bug in the AI. No one may even notice.
Why does US company must pay European Union tax
I would actually be interested in hearing some of the issues related to LPGL in video games and other projects. Are there stories / write ups on this that you could link to or would you mind explaining it some?
Ah, yes, certificate patrol[0]. However, your argument, I think, is not valid. Sure, it's technically possible for him to know if any cert changes, but in reality very few people are going to install the extension and those that do might not even notice the message because it notifies the user so frequently (fully desensitizing them I imagine).

I don't think that his choice not to install an extension invalidates his argument.

[0]: https://addons.mozilla.org/en-us/firefox/addon/certificate-p...
"At this point, the odds are close to one that every target has had its private keys extracted by multiple intelligence agencies" Any proof of this?
The problem was that the names are too close to each other and was one typo away from mysterious bugs. The non-existence of documentation didn't help either.
Dear all,

Thanks in part to this debate, we have opted to reduce the interest Zidisha borrowers may offer to lenders. You may view the full announcement and discussion here:

https://news.ycombinator.com/item?id=7558816
"after re-mapping the data so it becomes separable" This is sort of the hard part.
The discussion from a hundred days ago has some useful information: https://news.ycombinator.com/item?id=6971127
It follows the technical definition of "assault rifle". The category was defined by the Nazi StG 44: reduced power cartridge (compared to "full power" battle rifle cartridges like the 7.5 Swiss used previously, our .30-06 -> 7.62 NATO, Russia's 7.62x54 rimmed cartridge, etc.) and selective fire, full auto capable. It adopted innovations since then, like straight line recoil (also adopted by the Stwg 57) and 3 round burst mode for more controlled supressive fire.

The size is a tricky question. Don't know about the interior ballistics of your Gw Pat 90 bullet, although Wikipedia says it's properly "designed for terminal ballistic instability".

This is very important, because as discovered by Martin Fackler in the '80s, 5.56x45mm Full Metal Jacket (FMJ) ammo as fielded by the US is terrible at producing field disabling wounds unless, when it tumbles (as all bullets do when changing media from air to whatever), it ideally does so at a high enough velocity for it to break at the cannelure (the crimp in the jacket that helps hold everything together), and ideally the back portion then fragments. Otherwise it does little more than poke a pencil hole through a human, with a flip to exiting rear ended (which by itself, per Fackler's research, tends to do little damage, as does the high velocity shock waves), and of course this assumes bone isn't significantly hit etc.

In practice, we, the US, have seen it isn't a very effective cartridge, and that's not a surprise given how it was forced on the US Army (an action which wasn't, BTW, inherently incorrect, for that part of the Army was very corrupt).

The rule of thumb is that for every inch you chop off the barrel, you lose 50 yards/46 meters of effectiveness. So those who care about this, like the US Marines, still use 20 inch barrels, the M16 vs. the M4 carbine at 14.5 inches.

And strangely enough, so follows the SG 55x models, per Wikipedia:

SG 550: 528 mm (20.8 in)
SG 551: 363 mm (14.3 in)
SG 552 Commando: 226 mm (8.9 in)
SG 553: 227 mm (8.9 in)

And you're correct, if you're doing pure assault stuff, short range action, chopping the barrel to 551 or 552/3 length can get the job done. But as we've found in e.g. Afghanistan, 551/M4 length is disastrous if you have to "reach out and touch someone".

And thanks for all the "on the ground" information you've provided about the current situation over there.
Google itself hijacks / (forward slash) which I use in Firefox for quick search. Super annoying.
I understand a certain level of displeasure at their lack of specificity while they mitigated the issue. But... in this case, the time to remediate doesn't really change your response to the threat. No matter what, you need to change all your keys, generate new private keys, etc.

They got it fixed within 48 hours, globally, which, if you ask me, is incredible at their scale.

I would hardly describe anything AWS does as amateur. But maybe that's just me.
LHCb at CERN confirms new exotic state, possible tetraquark
Heartbleed Bug: Public urged to reset all passwords
Mark Cuban wants to take over texting
Obviously they were working as fast as they possibly could without risking major outages. They probably had millions of servers to update.

I'd even argue that it's not a good idea to advertise, "these servers are vulnerable to this attack".

AWS is massive and organizing that kind of update by an army of engineers isn't easy.

You received a non-personalized message because AWS support probably received tens of thousands of irate customers demanding that their systems be patched immediately. For some reason they weren't equipped to handle that kind of update but I'm sure they will learn from this and hopefully next time the response will be faster, if possible.
Seven boss battles that should really be impossible
Back Links Are Here To Stay
Quora raises $80 million at a near-unicorn valuation
Someone at blogspot needs a smack on the head. The site takes several seconds to load, which is absolutely ludicrous for displaying plain text, and when it finally does it's unusable as you've noted.
This post was written in Aug 2011. I believe ag wasn't publicly released till Dec 2011.

http://geoff.greer.fm/2011/12/27/the-silver-searcher-better-...
Yahoo Mail hijacked the down arrow: Looking in the preview pain, press down arrow to scroll... and you jump to a new mail. Very, very jarring and frustrating. I recall they also hijacked a bunch of other keys, none of which made much sense, which is sad... mostly because it shows that they don't use their own products enough to see how this can affect users.
> Sorry, don't think supporting an antigay candidate and a specific antigay law are the same thing

A specific anti-gay law that stripped existing rights from people, at that. Yeah, it's very different.
2GB, ADM Dual-Core C60, 1.333GH, on Linux, Chrome browser, no lag and smooth.
For future reference, AWS security bulletins can be found at:

https://aws.amazon.com/security/security-bulletins/

The author suggests that Amazon only made one post, updating it throughout the process. But at the link above you will see four posts regarding this issue, with the first one having been updated once to add information. No, they are not timestamped, but they are dated.

While it may be fair to criticize AWS for its customer communications during this process, I'm fairly certain that if he had a backstage pass to such a comprehensive process of remediating thousands of production systems with zero downtime, he would perhaps find the team somewhat less... amateurish.
From your comment, I can't understand why defining a special struct in C is different from defining a special type in Haskell.

I understand that many C programmers don't do it, mind you, but how is that different from a Haskell programmer not using the proper type for a certain operation?
Augmenting the reality of boring workouts
Requiring tons of javascript and seconds of load time to display plaintext? Yeah, that is pretty crazy.
How to Hide the WhatsApp Last Seen Timestamp on your iOS and Android Devices
The nature of slavery as well. In ancient times they were more like mistreated servants. Now it's far worse
Dear readers, please change your Ars account passwords ASAP
I believe 'Hunt the Wumpus' was the first game I played, but quickly followed by star trek. And then 'Eliza.' Geez, takes me back.

Star Trek was great because you could really lose yourself in it for a while. It was the start of my horrible game addiction!
Show HN: Bowery sets up your  dev environment in  less than 30 seconds
I really hope this is successful. But to me, animation performance is really a small problem in the larger problem of deploying HTML as an app. Sure, having something that performs on par with native apps is great. But, both Ionic and WinJS seem to be tackling that problem right now. And, both don't use some esoteric 3D rendering engine and are fully compliant with Angular or anything else you want to use.

The bigger problem, in my mind at least, is gaining full access to the same APIs that are available to native DEVs. Cordova does a pretty good job, but if you go off their core APIs then you are stuck trying to build or figure out plugins, which is less than ideal.
Well, really the consequences would have been virtually the same either way, since the number of OpenSSL deployments where the system malloc uses guard pages is a rounding error.
If you're talking about unintentional contamination during manufacturing (for example http://en.wikipedia.org/wiki/Melamine#Melamine_poisoning_by_...), Soylent would not necessarily protect against that. Though one would hope they have sufficiently adequate quality control practices to spot any such contamination before it reaches customers.
> It's simply a matter of observable fact. If you write in C/C++, you are far more likely to introduce security vulnerabilities than in other languages; therefore, unless there's a pressing reason to use these languages, don't.

And in the case of crypto code, one could argue that there is a very good reason to use C/C++: to prevent timing attacks.