skysight-inc/HackerNews huggingface dataset:
It is indeed astonishing how simple-minded this bug is. But these bugs come in all levels of complexity, from simple overstuffed buffers to logical ping-pong that hurts your brain when you try to follow it. We need to get rid of them once and for all. If the whole world can't use a certain tool effectively, then the whole world isn't broken; the tool is bad.
You made me curios enough to browse barista's comments history and they are very biased pro-Google anti-Microsoft, to an extent almost all of the comments focus on that. The account does seem fishy.
This mirrors my experience.

Javascript is so basic (pun intended), it's not even considered a real language. Someone who tweaks Wordpress templates wouldn't consider himself a programmer.
Rackspace offers DNS with all cloud accounts and doesn't charge for it and as far as I know, you can sign up for a cloud account and not actually purchase any services, though I would probably put some files in Cloud Files so you're at least paying them something to keep the account around. You can update your records via their API or via their control panel and there are no per-change or per-domain fees.
A Satellite Startup Could Be Google’s Next Purchase
Basically yes. However, from my experience, package update urgencies are no good indicator of the updates's actual priority.
It's in the +*-security" channels and you're supposed to apply all updates from there.
And who will categorize all the companies and make sure that they are not mis-representing themselves?
We really need to see some of the big companies take down their services until they've fixed this and call out for every company out there to audit themselves and confirm to users that this is serious and should be checked and that no service should stay online until they've patched their systems. This should get attention beyond just techies. Business as usual is not acceptable since every day that goes by is the opportunity for someone to take advantage of this and get the keys to your service and all past traffic.

I would not be surprised if people at the NSA, GHCQ and most state security services are going into overdrive right now to get access to anything and everything that is vulnerable to this bug.
Maybe a better analogy would be roll bars or seat belts: If they help prevent something from breaking, you've already screwed up.

Nothing can prevent bad drivers from driving poorly, and nothing can prevent apathetic programmers from writing insecure code. However, even though I tend to program in C, I can still appreciate environments that will catch dumb mistakes for me and prevent them from turning into security issues.
Indeed. And also how they've vanished since I saw them this morning.
> It costs you the same amount to get from the Airport downtown on a Friday night as it does Tuesday at midday.

Only in a world with unlimited supply. When demand peaks, you'll either have the price increased ("surge pricing") or people will have to go without when supply can't mean demand.
The "advent of remote work" may be upon us, but a lot of places aren't really on-board yet. Go look at any job listings site — remote work is very much not the rule.
And yet, I still am able to work here. Barely, but still (helps that we have our own line from the office).
I think you have never been laid off.

I know a few H1-B visa holders who were and I cannot imagine the stress they went through. Fortunately they all found jobs in time, although when you've got a time limit, you end up making some compromises.
Tutorials for Data Scientists
This may be a classic "bad idea" without some additional layers of security for precisely the reason you might intuit, drugs and other contraband. I have been a heavy user of courier services in the recent past (having been involved with media/PR agencies) and I know from experience that courier services in NYC do not and will not work with you if you haven't set up an account and/or don't have a physical place of business for them to pick up from. Try walking into a courier company's office with a package in hand and they won't take it from you without an established account.

Granted, you could argue that makes for a business opportunity for Uber, but in my experience as a long time NYC resident when you see safety measures and precautions like that which are ubiquitous to business practices there's usually a reason, namely that if there's any way at all to take advantage of a situation in this city there will always be 11 people lined up to do it within seconds.
Top ten social networks that all photographers must use
My Linux Mint machine (based on 13.10) went from 1.0.1e Feb 2014 to 1.01 Mar 2012 int the last 2 hours, so that's definitely new.
That would've been very possible in Emacs. Oh well. http://www.gnu.org/software/emacs/manual/html_node/emacs/Rec...
Maybe it's because you don't typically see an "app" that is just completely unusable on your device.

When the vast majority of simple websites (not even applications) have terrible experiences on mobile web browsers, is it really any surprise that users prefer using an app that at least puts effort into being usable?

HN and at least 80% of the linked articles I read on my commute have terrible mobile interfaces.

I really don't see the "performance" argument. It's unlikely anything you build natively is going to compete with a browser's raw HTML/CSS performance. That's something they do incredibly well. And really, that's all a static blog needs to be. I don't need your comments. I don't need your ads. I don't need your HTTPS. I don't need your massively broken up application that requires a GET for every asset on the page (and the 20+ JS files you've decided not to package together, none of which is needed). I don't need your parallax effects, your hover/click listeners, your scroll events, your damn lightboxes, or your image rotators.

At the end of the day, I don't use the mobile web very much. It's not because mobile web sucks. It's because nearly everything on the mobile web sucks.
With Starcraft 2 there's a feature to "watch a reply with a friend". Perhaps this is an easy way for them to get the same functionality without having to build in a replay viewer

There's also a whole audience of people on twitch who watch live streams of games with merely the player commenting into their headset as they go regarding why they're doing something (sometimes not even that!).

So there's two instances without editing already in wide use today.
I think your sarcasm-meter failed you.
I was wondering how hard it would be to convert a 40' high cube cargo container into living space. Tricky to get light in but renting a plasma cutter is fairly inexpensive. You'd get to start with a nicely durable structure for not too much more than they paid for the trailer platform.
Remote work is lowering some barriers, but others aren't so easily fixed.

I'm a first-gen immigrant. My family originally moved because of rampant pollution due to unrestrained industrialization, as well as geopolitical risks (having air/bomb raid drills in school isn't really that fun). Telecommuting doesn't really fix these.

Suffice it to say, emigration/immigration is a Big Deal for the people who do it, and for the most part it isn't being done simply because the jobs are better. There are usually far more fundamental concerns behind the decision, a better economy is just one factor out of many.
How did you get past 'must be eligible to work in us' restriction? Did they sponsor your visa?
What worries me about this is that the commit that fixes it [0] doesn't include any tests. Is that normal in crypto? If I committed a fix to a show-stopper bug without any tests at my day job I'd feel very amateur.

[0] http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=...
Are salaries rising for "high-skilled" domestic workers?
And from an economic competitiveness aspect, as a world?
SwiftKey and Nova Launcher would be near the top of my list.
I've had this same criticism of audio A/B tests: 30 second clips are just not decent to get a sense of the feeling a particular setup or recording imbues; only its quantitative momentarily detectable constructs. And only the ones the puny human brain and ear can discretely identify and remember, at that.
Okay, how? They're pretty much exactly the same typeface, except for some minor angles in some letters.
It's worse than that. I don't hate Microsoft or Oracle anymore. I'm completely apathetic. In my work I never have to touch either of their products.

The opposite of love is not hate. It's apathy.
>Also, if there's a shortage of talent, then the Silicon Valley CEO's can put an end to things like their conspiracy to drive down tech wages that is playing out in the courts, which is something that would obviously depress the number of engineers applying for jobs. Instead of the federal government cutting loans and grants to college students, they could expand them if they want more engineers.

You can't expect the Silicon Valley ~~CEO~~ Royalty to be bothered with something as plebeian as the free market. Much easier to get some programming serf imported to do the job and then throw them off the land once they aren't needed anymore.
Mirror please?
Oh, I didn't know about that, thanks!
There are open support tickets in both Heroku and AWS about the impact of this bug but no answers yet.

I hope folks will promote a warning if either platform is effected both on HackerNews and twitter.
Man I wish these companies stopped assigning flavors to the their roasts and just listed them as medium, dark or light.

I like medium roasts, every other is either lost on me or is not guaranteed to be consistent between roasts.
That's simply not true. CS internships vary widely in compensation and often approach entry level wages. I know interns making 7500 a month at Palantir, 4800 at Intel, 6500 at Amazon,and others. All of them have different relocation, housing, and other benefits on top of salary. None of these interns are from where they are interning, they all are flying out to live in a different state off of their own dime. Some of them even had to fly in to interview (as a freaken intern!). The CS job market is weird right now.
I think servowire is correct - you need time off. It can get to the point where you simply cannot work.

My advice would be to just quit. Your mental and physical health is more important than anything else. There are always other opportunities out there. You could even work at a non-computer job for a while, and possibly work on your own projects in your spare time (once you get your motivation back).

Having suffered from burnout myself, I think it was actually a useful experience, as it forced me to make changes to my life and I am now living a much more fulfilling lifestyle.

I'm happy to chat more privately.
If Chrome is the first to render CJK, all CJK become squares on Windows 7
I don't see how this is a valid argument against anything that I have said. I can argue that many people could have been even more highly regarded who were born in the US if we concentrated on the problems within the country using other means than pulling people from outside the country.

I also don't see a direct criticism or counter argument to anything that I said. Downvoters offer no explanation on their disagreement. I wish down voting would require a comment, or at least an identifier of who did it. I think that this would be a much better change than that stupid pending comments thing that almost saw the light of day.

Blindly downvoting without any accountability is a pretty poor reality IMO.
Attention!

The main site is overloaded, but I've set up a mirror at: http://alexnisnevich.github.io/untrusted/

All level-loading issues should be resolved on it, since they were tied to AJAX failures. Let me know if you experience any problems on the mirror site.
Hash them to 64 bits, deal with occasional collisions, which will be unlikely in any real world scenario.
It's even better to do both, and embrace a complete and holistic argument.
(Personal opinion) It isn't the United States that's attractive. It's the tech-hubs within it. I would never seriously consider moving anywhere but a handful of cities / areas in the US. The eco-systems in those places are still years ahead of London or Berlin.

I moved from Sweden to the United Kingdom to attend university for similar reasons. The university culture is different (much better) here, and there is more of a hub factor to the campuses, which offers many advantages socially and otherwise.
If you have a char* buf; block you got from network stack and you have to copy buf[3] bytes from the position buf+15 then the compiler doesn't know what to check for if you don't cross the boundary of that buffer.
Sure, but that's the fun part. There are exceptions, obviously, just don't make them the rule.
Digital Cash Will Starve the Homeless
After Raising $250 Million, Lyft Cuts Prices By Up To 20% In All Markets
I opened a support ticket, and Amazon just responded to say that yes, ELBs are vulnerable. I've posted their reply into that thread.
There aren't necessarily "many, many more" quality interns to chose from for these companies. There is labor shortage in the tech industry right now and some interns are quite capable of contributing real work. That makes them valuable and gives them leverage. It is not unheard of for interns to pit big companies against each other for a better offer these days.
http://gochargenow.com/locker.html
Yes.

I work in the area and have probably researched it more than most... and from quite some number of angles (social, technical, regulatory, etc.). My take is that an asset-neutral, settlement-system neutral transaction layer will certainly emerge.

This layer will provide (1) a suitably generic model of transaction state (2) hooks for cryptographic, reputation and logistics/provisioning systems (3) precise but extensible description of transactions including both traditional and digital goods and services

It will also facilitate a digital market for RFQs and quotes, and become as important to the JIT/decentralized manufacturing industry, spare parts supply business and the management of power on electrical grids as it will be to general purchasing.

Our children will find it inconceivable that archaic, limited, centralized, third party, centralized trust based platforms such as Alibaba, Amazon, eBay, SAP or Taobao and their rudimentary reputation systems ever existed.

I've put some thoughts and proposals online at http://ifex-project.org/ .. some of these are in live use already .. but very interested in any feedback.
If the supply of "highly skilled" people could not keep up with demand (which is what these companies lobbying Congress for uncapped H1Bs are effectively saying is the case), then salaries would be rising.

They are not.

/end of story. All other propaganda and testimony by these companies that say otherwise is bullshit.
But couldn't it be the case that with this bug you could sweep private keys from server's memory if they happen to be in there, because bitcoind is using them at the moment?
No, no I'm not.

The rules for markets are man-made. No markets would exist without humans. Humans created markets to serve themselves. As such the rules that govern how markets operate can be changed to serve humans. This is very easy to understand, wouldn't you agree?

Now comes the question: does HFT serve humans? Some people say yes, others say no. Some argue that they add liquidity and thus earn their fees. Others say no, they don't add liquidity (since they tend not to trade during rough times).

Still others say they add negative liquidity: when the markets are plenty liquid they rob market makers of deal flow (thus reducing market makers ability to earn a living) and then when things get tumultuous they shut down first taking the extra liquidity with them and also having the secondary effect of fewer market makers thus reducing liquidity further.

Market makers are able to make money because of the uncorrelated order flow that they receive as market makers. But there are HFT firms which are inserting themselves between brokerages and market makers, and paying millions for the privilege. That means they take profits from the market maker and after receiving their cut, provide some of it to the brokerages originating the orders. Is that good or bad? I honestly don't know. I might lean towards it being bad since the HFT firms have no obligation to keep trading. But they might very well reduce spreads. And if they are reducing spreads there is value to that.

http://www.businessinsider.com/brokerages-make-millions-sell...

So let's assume for a moment that they do reduce spreads (good) but they also reduce liquidity during crises (bad). That is the very definition of what is called an engineering tradeoff. What is your design criteria? What are your goals?

Engineering tradeoffs are at the heart of why basically everything is the way it is. Why are some cars faster and why do others get better gas mileage? Why are some bridges built with steel and others with concrete and others with wood? Why do some phones have a lot of battery life and other phones have a lot of features?

So I've heard plenty about how HFT firms reduce spreads, and many argue that it's a good thing. But they're not an unmitigated good! There are downsides to HFT as well. Which should win out? That's more a matter of opinion than fact.
> actually very effective at showing that masterwork violins do not necessarily sound better than modern violins

Really, it's only effective at showing that an unadjusted violin with strings of an unknown age doesn't necessarily sound better than a younger violin with younger strings, that has been recently adjusted...
Your Most Important Project
How a Harvard Case Study About Apple Was Turned Into Manga
Oh, hmm. Does anyone know how much power it uses when idling?
This article is slightly misleading, IMO.

The agency working on my application specifically timed it so that my application was submitted on April 1st, when the applications initially opened, instead of in November when I submitted the paperwork. If all agencies time applications this way, then the reason that all applications were exhausted within a week is because the entire year's applicants queued up until their requests were submitted this week.

This does not detract from the fact that there are too few visas granted, however, the situation isn't quite as insane as you would expect from reading this article.
I believe when people refer to "Mobile Web" they're talking about accessing information through browser apps. That doesn't include embedded web views inside of native apps.

Much of what has made the web so successful is that it is an interconnected collection of documents. A CNet article can link to a tweet on Twitter and vice versa. This is impossible in native apps and embedded web views don't change that.

It's possible that native apps can interconnect but the barrier is pretty large. You have fragmentation of proprietary OSes and no open standards (AFAIK) to make this work.

That's what makes this all so sad to me. I'm not quite sure how we've ended up in this situation but the long term outlook is concerning.
This looks pretty good.

I've been working on a freetext question answering service, but more the question answering part (as opposed to the voice recognition side).

Looking at the documentation[1], it appears there is no way for it to handle free text questions ("What is population of X?" - where X is any country) since all words need to be defined in advance. Is that correct or am I missing something?

[1] http://jasperproject.github.io/documentation/api/standard/
I think SPF is happy if the bounce address (envelope from) is replaced but the From: header is intact.
The parent is wrong though. It is not the duty of merchants to inform you that something is illegal.

http://en.wikipedia.org/wiki/Ignorantia_juris_non_excusat

In the case of uber you might attempt to make the case that uber is enabling/encouraging/paying people to break the law. That is illegal by itself.
New Paleo Diet – SHOCKING Celeb Weight Loss
> Another thing is that there is something of a cultural identity crisis going on. We cannot match the enormous cultural influence of the US, and so a lot of our culture is American.

I don't think that applies to music genres. I live in Gloucester, England which is practically in the middle of Jungle country.
Any good DMS of that calibre can't be disabled. The operator must take upfront payment and not care if you die or not, only fulfilling a contract you can't go back on. Sounds like something a Swiss bank could do for you, if stereotype is to be believed.
"Employees seldom see a big payoff. Period."

Yeah this is an obvious but oft-overlooked fact. As a VC you can manage the high rate of failure of startups by investing in many of them simultaneously.. that's what the whole model is based on.

As an employee, not so much, you're probably doing 2 fulltime jobs worth of work for one single company very likely to fail.

This is why working for shitty pay in return for non-founder equity is a very -EV financial move (I'll allow that maybe it makes sense for some people as a learning experience or whatever). And this is without even getting into the fact that your company could have a very successful exit and your equity could still evaporate due to dilution or outright clawback of options (ala Zynga's pre-IPO moves), or any number of dick moves from the founders/investors.
Or if you rent out a room in your house while you're still staying there.
I don't think that's true.

That is a big factor in the accuracy of speech-to-text engines, but I don't think training data is a problem for text-to-speech (which is what the OP was complaining about).
search and replace as the last launch step
Highlighting the text was really the only way I found some of the edit boxes.
Diagnosis of the OpenSSL Heartbleed Bug
Sure, native apps have better performance on mobile. But the same thing is true on desktop, yet the web somehow stays popular on desktop. That suggests that the behavior of platform owners (Apple and Google) is the real reason for the popularity of apps on mobile, and performance is just a distraction.
Wait a minute. She claims:

"Now a lot of you found it easy to pick the Strad... But it wasn't actually our task to pick the Italian in this study -- it was to pick our preference."

But NPR directly quotes the guy who ran the study:

"JOYCE: Curtin says of the 17 players who were asked to choose which were the old Italians...

CURTIN: Seven said they couldn't. Seven got it wrong, and only three got it right." [1]

Maybe she wasn't one of the 17 asked, but it definitely was studied.

[1] http://www.npr.org/templates/transcript/transcript.php?story...
Amazon Elastic Load Balancers are affected by CVE-2014-0160/Heartbleed
> In a 64-bit architecture, the data bus or datapath width will be 64-bit long. That is, we only have 2^64 unique numbers to pass in the CPU at a time. What's the best to do when we need more unique figures?

Use data structures that are too big to fit in the CPU all at once. The same way that we did on 8-bit CPUs when we needed more than 256 unique ID values. The problem is vastly more rare with 64-bit machines, but the solution remains the same.

Obviously, comparing such value takes more clock cycles than comparing values that fit in the CPU all at once, but that's the price you have to pay.

> Use unsigned integers, for instance?

Signed vs. unsigned, with the same width, provides the same number of unique values. Just different values. So that wouldn't help.
I agree and even within the CS field it can be a very different story. I had no problems getting a traineeships as a programmer (fun and challenging!) but eventually I would like to find a job focused on usability engineering.

It's almost impossible to find a job in that field (unless you have a lot of experience and proven results).
What? Every mailing list I've ever subscribed to has the original sender in the "From" field and the mailing list address in the "To" field. Otherwise how would you know who sent the message to the list?