skysight-inc/HackerNews huggingface dataset:
My grandfather had at least two pistols on him on any trip out of town. I'm guessing that's the license he had considering he was 82nd (later 101st) Airborne and then head of an AP (Air Force MP) outfit.
NSA denies knowing about Heartbleed bug before it was made public
The problem with distributions is that you, in most cases, don't know who is on the other end of the security@xxx.tld email address.

Being google engineers, they should have direct contacts with Cloudflare and some other high-profile targets.
This is according to "two people familiar with the matter". While nobody would be surprised that the NSA had exploited heartbleed, this article gives no compelling proof.

I wish newspaper articles had a bit of metadata that indicated whether the sources are verifiable. Then we wouldn't have to waste any time reading them when they aren't.
kovrik, if you seriously put your mind on it, you can move out of Russia. I won't say "effortlessly", but it is probably easier than you think.

Make sure to do your research – e.g. countries like Australia and Canada are much easier to move to than US or EU. IT professionals are in high demand everywhere. You can start by working remotely, etc.

Good luck.
Actually, no. I just recently read about this.

1 + omega == omega < omega + 1 < omega^2

http://en.wikipedia.org/wiki/Ordinal_number
Out of curiosity, I did some research on SpoonRocket. First, I caught the article author deliberately misrepresenting the Series A:

"it’s just raised $10 million in venture capital expressly so it can keep its prices low". The linked article said nothing of the sort. It said Series A, yes, but not that it was to subsidize pricing. Second, that Series A just happened on April 9 - this week. They haven't had time to even cash the checks yet! (they had a $2.5M seed in 2013, per Crunchbase. If VC thought that money was wasted on cost-cutting, they wouldn't be paying Series A)

Second, SpoonRocket differs in a couple of ways. First, they're a food+delivery service. They don't drive for other restaurants, and they don't have a restaurant space (and associated costs for service and location-driven rent).
They only do two meal choices a day, and those are driven by ingredient availability. They're much more like a wholesale bakery than a restaurant.

Their technical edge isn't just communication, either. They have heating systems built into the cars. So I'm assuming they simply fill the cars with meals and send them out, using software to track closest car to the customers, in a high-density urban area. When a car runs out of meals, just come back for a refill.

This is an extremely efficient model, for both food production and delivery, outstripping the benefits of restaurants that have to offer a diverse choice-driven menu, and delivery services that have to do one-off deliveries to support that consumer customization of their food.

So I think it is absolutely reasonable that they could profitably deliver $8 meals.
"There are collisions because people don't pay enough attention. Imagine if we installed a collision detection system, people would pay even less attention!"

I hadn't heard this line of argument before.
I'm interested in how the payments by third-party companies to OpenSSL foundation for white labeled FIPS-mode OpenSSL are accounted for. Maybe it's a seperate entity?
No one doubts that there were advantages to NUL-terminated strings, but against them you have to weigh the many thousands of security holes that were thereby created.
You know, even my bank has a special warning up about Heartbleed. I also saw it as #1 on BBC News at some point, fed to my Android phone's news, etc. It's a surprisingly big deal.
Seems a bit excessive, guilty criminal almost.
http://earlyandoften.wordpress.com/2011/12/17/dependency-man...
I've been working on building a set of basic music patches simultaneously in ChucK, PureData, SuperCollider and Pyo. The idea is to produce patches which produce the identical sound, to illustrate the differences between the music languages.

I have a long background as a C programmer. Because ChucK is C-like, I have had the least trouble learning it, of the 4 languages mentioned above. The simple stuff I implement in ChucK tends to work the first time. However, my musician friends who are not C programmers tend to find visual patching languages (like PureData and Max) far more intuitive.

Performance-wise, ChucK seems to me to be the least performant of the 4 mentioned above, however, for my needs it works fine, and I look forward to doing more work with it.
You'd be surprised about the number of emails I've received from people who apparently don't care about their email/website asking if it was vulnerable to the heartbleed/heartbug/heartbeetle/heartblood malware/virus/bug/issue/exploit in the past week.

Though I must say I find it funny all the different names/what exactly it is I've seen.
> Are there any cases where the actions of the NSA are in any way beneficial to US citizens? Can they show that they have ever done anything positive at all?

Yes, and quite easily.

If that's your only testing criteria for whether a government agency is useful then NSA will pass with flying colors.
Nel circondario tutto è possibile
Huh? Not sure if speeding counts as bizarre.
Probably none, what with game theory and the free-rider problem.

Or, as it seems, about $2k.
Hacker, troll, borderline-criminal harasser. He's got his own wikipedia...
I can help you get kinky wholesale products, dsugarman [at] hdtradeservices.com
Get a closer look at Dropbox's Project Harmony [video]
If they could pay one guy to manage and work on it, I'm sure that approve things.
Is that for counterfeiting, or security
Also anyone that can afford posting their own bond instead of lieu of an insurance requirement also has their own legal representation.
Obviously they don't just send the exploit directly in mail to a mailing list. Email, ask to talk to someone over the phone, explain the situation to that person, ask for references on prior releases being well-handled.

I want to avoid Monday morning quarterbacking, though. In hindsight the right course of action is always obvious.
I think you need to give your definition of the word "kinky" before posting that message ;)
Obviously Rice won't change much about Dropbox policy and practices either way. I don't think that's really the problem here.

The problem here is what kind of ethics, common sense, or both we can expect from a company who puts somebody on their board who as far as the majority of the population of this planet is concerned should be standing trial for crimes against humanity.
A related tweet of mine on that same subject circa 2010: https://twitter.com/tpurves/status/19352426907

"Swearing at brands on twitter really is the new and awesome 'nuclear option' for receiving full-on customer support."

back when brands were first getting on twitter, and those of us with a few followers suddenly realize the huge power those brands had accidentally handed over. e.g. Cable internet companies that would normally jerk you around and put you on hold for hours, but one little slightly-swear-word-infused tweet and suddenly you get gold-plated service. Those days were awesome.
I believe the biggest danger with speeding is related to the speed difference between various vehicles on the road, than the actual speed itself. So what you're suggesting would make it more dangerous, not less, with different groups of vehicles moving at significantly different speeds than others they're sharing the road with.

edited to add:
http://en.wikipedia.org/wiki/Solomon_curve
Libertarian Paradise!
Rounding error in donations, but easily $X0k+ to purchase proactive mitigation. It's not like (without loss of generality) Yahoo is a stranger to paying for engineers, security technology, software licenses, or insurance policies.
Creative Destruction in Eleven Parts
Side drawer navigation could be costing you half your user engagement
>Next question: "Here's a capacitor..."

What are you, some kind of sadist?
Nobody will deny her experience in the "expand into new countries" bullet point, at least. They should get Putin on board as well, I'm told he too has an impressive CV and a big address book.
>The margins for counterfeiting this part can't have been very good.

Unless they were stolen, and repackaged in order to hide their origin. Like a chop shop, only no chopping
Well, yeah. But snark aside, I did a little research on the startup shamed in the article, and their business model actually looks viable to me. They have a couple of serious efficiency advantages over the existing models (no restaurant + limited menu + software managed delivery). I don't think an $8 delivered meal is out of the realm of possibility with their model.
Rents have been skewing much higher than mortgage costs for some time. I'd guess it's 2-3 mo. of rent, max. In silicon valley it might be 1-2mo.

But people often don't think rationally that way (and definitely not all the time). A large lump sum may seem bigger than it actually is. Which is why sales folks often try to peanut butter the costs over a range ("it's the cost of one coffee a day for a month!")
You are right about lock-in, but there is a significant convenience factor. I mean network effects as in eBay (more buyers, therefore more sellers, GOTO 10), not like Facebook (i.e friends).

If Uber has the largest fleet it really makes it hard for other services to compete as no one wants to check multiple apps for that (and the existence of aggregators a la Kayak needs some sort of open API, which I don't think exists).
Court Reverses Conviction of Security Researcher "Weev"
if people are doing this work for the money, doesn't that defeat the point?

What exactly do you think "the point" is. To not be compensated at all in any way for your work?

I see a BSDish license as an indication someone wants their work to be available to anyone. Not a statement that the product itself must be kept purely a labor of love.
It certainly would not defeat the point to pay the OpenSSL engineers. Free and open software is about your freedom to modify and share software, not about taking no money.

Open source software still costs a lot of money to make, and people do pay for it. Typically, companies like RedHat, Facebook and Google (and plenty of others, like Apple, and even Mircosoft) hire engineers in to full-time positions to work on open-source projects. That's how most open-source projects are funded. It's how Webkit grew. It's how Linux is built.

OpenSSL needs funding, and the biggest companies that depend on it will probably provide more assistance in the aftermath of heartbleed I expect. OpenSSL is so crucial, and we've just found out how exposed it is.
Quick denial. Interesting. Usually they say nothing.
This sounds dangerously close to a variation on the sunk costs fallacy. "Why abandon this code base when we're putting so much effort into it?"
From what I've heard this is really offered to employees deemed "under developed" which basically means they're shitty at their job. It's a clever way not to pay severance.
NSA has two jobs:

1. Gain signals intelligence on specified foreign targets.
2. Protect U.S. signals from having the same done to the U.S. by other states.

The second responsibility is why there are things like SELinux, NSA "Suite B" cryptography, etc. It has also led to security bugfixes to open source code (such as X.org) used by NSA or within government.

The reason that both duties are held in NSA is because the best way to defend against the best SIGINT hackers in the world is to have the expertise of the best SIGINT hackers in the world. It's why NFL teams have their offense practice against their own defense and vice versa.

In this case the flaw is so completely egregious (and relatively easy to spot for other states' spy agencies reviewing commit diffs) that the duty of NSA would quite clearly to have been to get OpenSSL fixed, if only because so much government IT could be affected by this.

The bug was introduced pre-Snowden as well, so it's not like NSA didn't have other cyber weapons to use to achieve the effects they need. So if it's true that NSA knew about the bug and let it remain open to protect "methods and sources" then they definitely chose wrong and someone needs to explain how they came to that choice...
"Trust us".

Yes, I trust that you revealed your real position.

Gaining marketshare is more important to you than user data privacy.

Got it!
My sister dated a cop for a while, and he offered to give her a PBA Card (Police Benevolence Association, what everyone calls the "Get out of jail free" card). She declined, not because she was particularly honorable or had an aversion to corruption, but because she said she would feel too awkward using it.

"What do I do? When they ask me for my license do I just...hold it out and say 'let me go please'?"
I'm unclear on how the operators are going out there without information on what to charge. It seems like we're making up "facts" here, then drawing convenient conclusions.
All real components have real impedance, not just resistance. So at a minimum you'd expect a new EE grad to at least model a resistor as a combination of resistance, capacitance, and inductance, and explain what contributes to each (i.e. a wirewound resistor has more inductance than a bulk metal foil, or something). For veteran industry EEs you'd also expect them to mention things like microphonics, self-heating, thermocoupling, etc.
🚨 Hilarious 🚨. (Sorry, I could only steal them in red today.)

✋ Don't leave me hangin', bro, it's Friday after all.
Where can we find these old talks?
Newsweek was purchased by some shady people and hasn't been famous for investigation for... ever?; Bloomberg is one of the leading financial periodicals which is a major part of the Bloomberg empire and hooked into all sorts of circles. Would you be so skeptical if it was being reported on nytimes.com?
Yes, this is a good point. I hope that what I meant was reasonably clear, but a more precise would have been something like "cannot prove certain assertions about data that are provided only after compilation".
"Is this capacitor charged? How do you know?"
This Is the End of Facebook as We Know It
All software has bugs. That's an unavoidable reality. You need to learn to deal with that fact.
100% agree. Here's a related question: How many people do you think the NSA employs to work on open source software and blend into the community, establish credibility, etc. Is the answer zero people? Given what we know about the NSA now, zero seems unlikely.
Anyone who wants to stay in the "hears-about-this-kind-of-thing-early" club should need to pay $10k/month (though of course membership in this club is still offered at OpenSSL's sole discretion, and they would be allowed to waive this fee).

Google, Amazon, Facebook, and Akamai (off the top of my head) will each pay that without batting an eye; that's $480k/yr. right there. I imagine they could probably get some banks in that club as well.
On some platforms, malloc(3) and free(3) are implemented in terms of mmap(2) and munmap(2). Which means, if you go beyond your buffer space, you'll end up in an unmapped page and cause a SIGSEGV or end up in NULL data.

Since they used the freelist/malloc wrappers, they avoided this trap.

Plus, IMO, if you're implementing a freelist, you're implementing 80% of what a malloc is anyways. It's _mostly_ freelist handling, the only way to add memory to a process aside from mmap(2) is setbrk(2). There's no way to give memory back, so they only thing left for a malloc implementation to do is create a freelist to reissue memory previously freed.

You can say you're still backed by malloc(3) if you want, but you're only getting the setbrk(2) handling and throwing away everything else it's trying to provide you.
In the UK if you have a Tier 2 visa then you apply for "Indefinite leave to remain" after 5 years of residency. The only restrictions are that you cannot spend more than 180 days outside the UK in any 12 months and your employer (sponsor) still needs you for your job.
The point is to secure communications for everyone, for free. Being paid wouldn't defeat that point; charging for the result would defeat that point.
Yup. One play might be to not display any affiliations or bumper stickers at all. If you have to advertise X, it seems like you're "trying too hard." Just as a non-cop, seeing NRA stickers is going to make me immediately assume irritable, gun-toting jerk.
HMO/HYO: I'm a PhD candidate in experimental physics looking to get some experience in real-world product development. I have lots of experience developing and fabricating one-off devices for our research, and I'd like to bring that background to bear on problems outside my field. I'd be happy to talk with anyone working on hardware problems. I'm probably not the guy to talk to about making a polished final product, but if you need a quick and dirty prototype or are hitting technical problems, I might be able to help.

Contact info is on my website: http://guavaduck.com. I'm in Seattle.
One of the claimed advantages of open source is to produce higher quality, more secure software.

"As a result, the open source model builds higher-quality, more secure, more easily integrated software. And it does it at a vastly accelerated pace, often at a lower cost." - http://www.redhat.com/about/whoisredhat/opensource.html for example.

As an ideology, comparing this OpenSSL happening to the stated goals of strong proponents open source, it is a complete failure of that ideology.

That it was then fixable is an advantage, but that's a separate thing. It doesn't offset the way a really common error in a change to a really common and important library sat unnoticed for two years ... until a private company paid security researcher found it.

You could argue that the bug was found and fixed and the software is now more secure :: the system works, this is how it works.

But this is not how open source proponents present it as working.

NB. This doesn't mean closed source is better. People don't push closed source as an ideology in the same way at all. But do compare open source to the claims made by open source advocates, as well as comparing it to the ease of fixing and finding bugs in closed source software.
There's plenty of both. NSA is wrapped with layers upon layers of process and oversight both, which is something re-confirmed in the wake of Snowden's revelations.

What people are shocked about is that they didn't understand what the law permitted, or how quickly mixing the law of induction with datacenters full of computers can led to global-level surveillance.

With all that said, I would mind if it's true NSA knew of this bug and left it alone. It's a powerful weapon for SIGINT to be sure, but it's too easy to find by other state spy agencies doing code review; NSA would have had to assume other nations knew about it at well and were putting US government and private-sector comms at risk.
Dropbox guys cannot be trusted therefore I have simply deleted the account.
Indeed, and maybe we'll see some of the big companies hire and assign people to work on it now. I hope so. It'd be good to see the code audited too, though I'm not sure how you'd go about that with a project like OpenSSL. I suspect it'd have to involved funding a PhD or two...
Motivation by general pride in your work and refusal to compromise on standards will drive you to do your job well, but it won't drive you to be "motivated" in the sense of wanting your job to go well.
In France, a Move to Limit Off-the-Clock Work Emails
Currently, it's a distraction-free writing program that syncs your writing across devices. People find the austere layout ran in fullscreen mode to help them focus on long writing sessions.

My wife and a friend of mine both "won" NaNoWriMo using a previous, desktop-only version. It was very similar to programs like ZenWriter or FocusWriter.

I've since rewritten it as a single-page web app to start to target a few features at smartphones. To that end, it sports a responsive layout that automatically drops you into a snippets form on mobile devices for quickly jotting down and saving ideas. The writing mode is also useable on a smartphone as well, but nobody has used it significantly for that yet, so I don't know if people find it very helpful.

I'd like to eventually build in better management of book-writing projects, basic formatting and ePub export, text analysis algorithms for honing the writing, and "creativity encouraging" minigames that serve to stimulate the writer out of writer's-block or teach us better writing habits.
Weird! Thanks for the link!
This is a dupe of https://news.ycombinator.com/item?id=7575139.

It's a good idea to check whether an article has been posted before. In the present case, running the title through HN Search returns the above pretty easily. When an article has already had attention on HN, we generally don't allow reposts for about a year. And when an article is already on the front page, as this one is, we definitely don't allow reposts. :)

Also, please follow the guidelines and do not editorialize titles.
>so why accuse him of attempting "to move traffic to the blog"?

Remember what I said...one of the first responses (3rd at worst) is someone posting the "proper" link to the actual article. That was there before I posted - someone else read the blog extracted the relevant info and concluded that the single link is the core content of the blog post. Then I put the same thing into words and go downvoted to hell. Oh well.

OP has since altered the link to point at the PBS article.

As I said before I don't doubt the technical ability or integrity of Mr Aaronson. I was commenting purely on the HN submission because I felt both the HN submission and blog were subpar & did an injustice towards the actual content (the PBS post). Downvote away...
That's new hires who've done at least a week of training, not applicants. There's a world of difference in between.
I expect it'll mostly be appreciated by the BDSM community, but it's for people of all (legal) kinky interests.
Changing Perceptions of Computer Vision
When you write something like this, please, make it clear you are being sarcastic at the start of the paragraph. I almost spilled my coffee over the keyboard.
So, first: I agree with patio11. But past that, this thread also bugs me because it is so ill-informed: the very first question that has to be asked is "what is the distribution of donation amounts", as the way to minimize processing fees of "we got one donor who gives almost $2k, and then a handful of people we choose not to turn away who give a few dollars each" is very different than how you handle "we have $2k donors, they all give a dollar". PayPal's micropayment fees are $0.05+5%, which is a massive difference from the default $0.30+2.9% quoted.

And if you have only one really large donors, you get them to give you a check. And then you put their name somewhere. And you send them some thank you letters. And you ask for their advice on how to talk to their friends, as maybe they might also want to donate. Because patio11 is just dead-on right: it is more useful to increase the incoming money here, not avoid losing some fees :/. But again: even if we choose to nitpick fees... this conversation is still going nowhere if the distribution of donations and the process of receiving them (if you have mostly random donations, having them do bank transfers is going to massively increase the loss rate ;P) is not where the discussion started.
Why Dropbox won’t drop Condoleezza Rice from its board
> who as far as the majority of the population of this planet is concerned should be standing trial for crimes against humanity.

What did she in particular do that would meet that bill, besides agree to serve in the Bush Administration? Can we at least wait a couple of weeks between witchhunts in the tech industry?
So is there a single shred of evidence besides something unquoted by `two people familiar with the matter said`

because if not this is just straight up link bait.