skysight-inc/HackerNews huggingface dataset:
I don't think it's so much how you (as an active developer does it) -- granted having to redistribute your app everytime any of (say) 10 bundled dependencies need an update is an inconvenience -- the biggest problem is when you have some old software (without vendor support) that is statically built with some overflow "built in" from an old version of a library.

Granted, at some point patches probably won't be backported, but it is convenient to be able to upgrade libssl, restart a few services and be done.

Of course, if you bought that software under GPL, you might be able to fix the issue yourself...
What I would rather have is a %$#@! CA cert signed by my registrar valid for *.my-domain.com for free. In what world should I have to pay annually for some asshole to run "openssl ca" on my behalf? Our whole CA system is bullshit.
And you've just described the current state of Open-Source video drivers in Linux.
Have you realized that not only OpenSSL, but any exploitable bug in any software that runs on servers (PHP, Apache, nginx, Linux, etc) should theoretically invalidate any certificate that is stored on those servers?
Let's admit StartSSL will revoke you. Then what ? Chrome will still don't check revoked certs. Mac OS X neither (and Safari). Only Firefox will...
FWIW inline C doesn't negate the advantages of using Haskell. It's inline.
Oh come on, really?
All right, forgive me for being negative but I can't take this project seriously.

https://medium.com/p/4790bf5f7743

>"Here are a few verticals where Ethereum could engender disruptive innovation:"

It's literally dripping with Silicon Valley Newspeak. This is the language of the serial entrepreneur, the one who is more interested in having his latest project acquired by a bigger fish for a hefty price than actually delivering a quality product.

Not to mention I'm so sick of everyone cramming "social" into everything. The "Social OS"? Yuck. I mean maybe I'm just jaded and cynical at 3am but Ethereum just seems so... phony.
AngularJS integration with Haskell
I've used delhanty's example in a large codebase and it worked well.

Another approach is to create a static library that overloads global memory operators (new, delete, and their variations). Link this static library to every DLL that you make, and have the implementation of these overloaded global memory operators use the heap of a single DLL. There may still be multiple heaps, but only one will be used.
Thanks pradn! I'll definitely have this level of customisation in the finished product.
AWS Free Usage Tier
Thanks for the feedback, Jesse - the demo is just intended to show functionality. In the full version you'll be able to choose stores to follow by country and gender, e.g. men's clothes from the U.S. version of J Crew.
I think Startcom are morally in the right about the payment issue and to have whatever business model they want. But at the same time that's a separate issue from their responsibilities as a CA and if that's compatible with their business model. I got burned by Heartbleed and I was proactive about getting my certs revoked because it never occurred to me that I should beg for a free revoke because it wasn't my fault or something. But now I see that Startcom is in a tought position because they should be revoking the guy's cert and just billing him, but his backlash is not atypical and free cert offers probably select for the type of person who will avoid paying for things at all costs.
Agreed. My post is targeted more towards technologists who are interested in building a business. For those who want to be top developers, I recommend to write code on a regular basis.

Thanks for your input, I have updated the post to state the same.
Exploring Machine Learning with Scikit-learn (PyCon 2014 video)
Ubiquitous electrical outlets cripple 1st worlder understanding of physics. Film at 11.
This is beautiful, it's one good idea after another, good job!
perhaps startssl is thinking about ending their free cert "business", much like how dyn has stopped free dyndns..
I'll notify the Haskell people straight away, sir.
Mozilla should just spin-off their own CA, pricing the service fairly as a non-profit. It's not like they aren't the gatekeepers anyway.

Users don't trust Verisign or StartSSL, they trust whoever Mozilla, Microsoft or Google trust. Stop accepting new CAs in to the browser whitelist, start a CA for the public good with a true open source, full disclosure mentality. Why not?
Use .forEach
The 90% refers to this specific strain of Ebola, the Zaire strain. The article does make some mistakes, though: for example, the cases in Sierra Leone are not yet confirmed to be Ebola.
I was doing 70 on the road out of Wallingford, and the police pulled me over.
There's no reason to think that. This has been their policy all along.
It doesn't say it needs to be free. It's perfectly reasonable to charge a nominal handling fee, as other CAs do for their services. What's special is that StartSSL offers their basic certificates for free, but this shouldn't make people feel entitled. Especially when someone exposes their private key on purpose they don't deserve special treatment in my book.
Corrosão e Proteção de Materiais em Estruturas Marítimas
SSLTest was having connectivity issues. Try again now.
Really, in scientific work like this, the temperatures should be measured in kelvin.
Why does a program compiled with VS need a specific DLL anyway?

Can't VS compile FOR Windows, with only the DLLs Windows provides by default?
> Why is the power of revocations in cert issuer's hands? As long as the private key is private

Because a major reason for revocation is when the private key has been compromised.
> Note that in the heap there are the intermediate values that and are used when constructing the connection and doing the encryption, you aren't exactly looking for '------BEGIN PRIVATE KEY------' or base64 string, you'd be looking for those - each which have a unique data type.

That's what I thought as well when I saw people POSTing strings like that and other people finding them. But when the key is first loaded from file, wouldn't actually all those base64 strings be in memory?

Probably just pretty unlikely that they would persist for a long time without being overwritten.
I think zero moisture would be this

http://en.wikipedia.org/wiki/Zwieback

which while great with butter & jam, does not qualify as a toast anymore :)
You need to explain what things do.

This page, for instance, doesn't explain what flexbox does.

http://learnlayout.com/flexbox.html
The author is running a business on the domains he's talking about (a crowdfunding site that takes a 3% fee [1]) so he should just regard it as an unplanned business expense and pay up if he feels it's so important for his certs to be revoked.

Not that revocation will have much practical effect on the unlikely event of his keys having been compromised, and an attacker considering his website important enough to MITM - and having the means to do so to a sufficiently large audience to make it worthwhile. Seems like a lot of fuss over nothing much, in this case.

EDIT: Also just to note that the private key he has shown on this website was compromised solely by him putting it there, and not extracted via Heartbleed. Indeed, the certificate was created a few days after the vulnerability was reported and fixed. Makes this strange cry for attention even more absurd.

[1] https://freedomsponsors.org/faq#How%20do%20payments%20work?
And the pillars were allowed to stay?
That seems kind of like putting all your eggs in one basket. I think the separation of powers is good, even if what it has produced right now is a bad situation.
Intelligence and Algorithm
You are right to point out that the date they patched their servers does not necessarily coincide with the date they reissued their certificate.

Unfortunately, it seems CloudFlare's new cert keeps the same dates as their previous one so only the serial number has changed afaik.

On the other hand, I just checked and indeed Google did reissue certs for most if not all of their domains on April 2nd http://pastebin.com/5Ry7XRAZ
Sure, just don't link against the C++ runtime library and you're good. Of course, you won't have anything said runtime lib provides, then. Or link the runtime statically, as suggested in a few other posts. Your binary size will increase then, though.
Arduino and Node.js Communication With Serial Ports
A public test suite wouldn't reveal features introduced by a hostile foreign government, such as a security backdoor that only activated in response to a secret key too long to brute force. Presumably for DARPA this is a worry.

Agree a public test suite would be good for other fake component risks though.
This graph illustrates the "sputtering": https://blockchain.info/charts/hash-rate
Penne with Red Diavolo Seafood Sauce Recipe
Ask HN: Negative OpenSSL sentiments
While I admit that the recent Heartbleed security issue is a critical issue, I am getting perpetually flummoxed by the 'I have the moral high ground' negative comments being thrown at the OpenSSL project & developers. Innumerable blogs and HN threads are taking the stand of 'how could they commit something like that', 'How idiotic was the committer', 'OpenSSL should not use a custom wrapper around malloc' and even taking personal shots at the two gentlemen who were referenced in the code.

Mistakes were made in code and processes, mistakes will continue to be made in code. What we need is:
* A formal code review tool. I don't know whether there's something like review-board for OpenSSL commits.
* Donations to the OpenSSL foundation. C'mon folks, practically all your online security depends on OpenSSL (Cisco, Juniper, Extreme, Huawei, Google, Yahoo, Wikipedia: I am looking at you). A bit of money back to OpenSSL (and OpenSSH + friends) would go a long way. Personally, I think these tools ought to be getting way more than Wikimedia (Just my two cents)
* More eyes on the code. Whether it's refactoring the code, formal code audits or full time employees from the fortune 500 companies.
* You to commit. This is an open project. 20/20 retrospective bashing does no one favours[1]. If you really feel strongly about something, get a patch out then start yammering about it.
* A security mailing list. Something similar to xen-security-announce. That way, major vendors, cloud providers, OS & distributions can get fixes baked by the time the general alarm is sent.

1.http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse
The problem is not that they're refusing to revoke, it's that you're refusing to pay for the service.
While I'm not sure if you're joking about mining as theft, if you're not, what you're saying makes perfect sense. Non ASIC based cryptocurrencies provide one of the greatest botnet monetization schemes I can imagine. Low-risk, hard to trace.
While working as a cell biologist, i followed a different approach: ignore the abstract, look at the figures, if still interested skim the materials and methods, and if still interested, read the rest.

The rationale for this is that the most interesting thing is what the authors have discovered, but it's only interesting if they've used sensible and relevant methods, and what is very unlikely to be interesting is the authors' attempt to convince you that the result is stronger and more important than it is.
I've also found The Magic of CSS useful: http://adamschwartz.co/magic-of-css/
Mozilla, Microsoft and Google are carrying the baskets. What you have now is N ways of getting compromised, because even the CAs you don't trust can issue certificates for your domains. To be honest, I'm being a bit tongue-in-cheek. I don't think Mozilla should really do this. I just think people should question this naive belief that the CA industry is out there to help the little guy paying ~$20 for a certificate for their blog or forum.
There was an interesting thread on the subject on the crypto-list last year ("How much does it cost to start a root CA ?"), see eg:

http://lists.randombit.net/pipermail/cryptography/2013-Janua...

http://lists.randombit.net/pipermail/cryptography/2013-Janua...

http://lists.randombit.net/pipermail/cryptography/2013-Janua...

And for good measure, on the subject of certs and trust, the thread after:

"another cert failure" (2011)

http://lists.randombit.net/pipermail/cryptography/2013-Janua...
"But, of course, if that had happened, maybe the web would never have taken off like it did, and maybe instead, we’d all be using a gigantic Lotus Notes network operated by AT&T. Shudder."

http://www.joelonsoftware.com/items/2008/03/17.html
Your comment is racist and stupid. I hope you are neither.
Desperately Seeking Linux Programmers
"And for what? A 180km/h faster train?"

Going an extra 110mph(180km/h) would be a huge win. It greatly extends the distance where a train wins over a jet.

Also consider, for instance, in the NYC area, you could live 100 miles away from Manhattan and easily commute to work. That means you could live in downtown Philly and work in Manhattan, 30 minutes away. The world becomes a lot smaller.
Meme is a common way of communication in Google, even formally.
That is a critical security flaw in Chrome (and your toy OS there with the fancy graphics).

Arguing that someone else made a mistake which renders your mistake unimportant under some circumstances is neither excuse nor justification, in particular not for continuing to make that mistake.
And here's a list of high profile web services hist by the bug:
http://hackingnews.com/vulnerability/heartbleed-hit-list-aff...
[semi-cross posted from: https://news.ycombinator.com/item?id=7557764]

There was an interesting thread on the subject of starting a CA on the crypto-list last year ("How much does it cost to start a root CA ?"), see eg:

http://lists.randombit.net/pipermail/cryptography/2013-Janua...

http://lists.randombit.net/pipermail/cryptography/2013-Janua...

http://lists.randombit.net/pipermail/cryptography/2013-Janua...

And for good measure, on the subject of certs and trust, the thread after:

"another cert failure" (2011)

http://lists.randombit.net/pipermail/cryptography/2013-Janua...
Freaky. So ... Dogbert quit and went to work at Amazon?
We have a lot of other medical research entities in the US (NIH, CDC, a bunch of top universities, private pharma...), and I think the DOD is probably responsible for very few of the breakthroughs of the past 100 years.

I'm not sure about the record of foreign governments, universities, companies, and other researchers, but I suspect the US is by far the biggest, but not the only. Just in the commercial world there are a lot of really excellent pharma and biotech companies outside the US - GSK, Roche, Bayer, Novartis, ...
What I learned in my first year as a female startup CEO
> The course of execution cannot be altered by the values of the input. Cache line eviction? All memory access is statically known in advance. Branch prediction? There are no branches

This might be what it looks like before GHC had its way with it. After GHC inlining, optimization passes, rewrite rules, the code may well contain branches, conditional memory accesses, etc.
I believe both Windows NT and OS X do it this way, in addition to closed-source video drivers for Linux and Android? Not certain, and I won't speculate about iOS.
As Raymond Chen explains at length in a few of his posts, this does not matter. Sure, there's a sense in which the bug is your fault for not being infallible, but what of that? We already knew we aren't infallible. The point is, that kind of live fire debugging punishes your users, not you. And as long as you keep doing it that way, it's going to end up hitting your users in a situation where you aren't around to fix the bug.

I did say you should use static linking in the release build. If you want to keep virtual machines with every version of Windows and/or the run-time library you can lay hands on in order to test debug builds of your program against them so you can find the bugs instead of letting users trip over them, there's certainly nothing wrong with that.
The SQL standard defines far more than you'd want in a web browser, and I'm not sure anyone actually wants all of it. So someone has to sit down and define which bits to cut out, anyway... and then browser developers have to develop a database engine, which I'm fairly sure none want to do. We barely have any open-source software that implements SQL correctly as it is.
Yes, you are correct. I was reacting defensively.

If you want to draw more conclusions, then you want different analysis anyway.

For anyone interested in playing a little with the global data in a very easy way, check out woodfortrees.org:

http://woodfortrees.org/plot/gistemp-dts/from:1960/mean:12/p...
What we need to know is when a given system was patched, that would tell you who knew what when. Is the Google fork of OpenSSL publicly maintained? Has anyone identified the commit that introduced the "bug"?
The way to know which principle you should follow is to ask yourself: am I in the position to set a de facto standard?

If you are, then be conservative in what you accept, and prevent whole categories of problems in the future.

If you're not, then it's too late for that. The damage is already done. Be liberal in what you accept, and try to mitigate the resulting harm.
Sounds awesome.

Please make a web based chat. Nothing worse than being forced to type on a phone when I'm already on a computer
I grew up with windows & windows dev tools and I always had a pragmatic appreciation for them, but lately I became quite bitter and cold towards Windows and Windows developers and this happened long before I started using alternatives. At one point it was very hard to avoid the feeling that something, somewhere deep in windows is rotten. With every new windows version from winXP on, I had the feeling that I'm being sold a slightly improved technological improvisation with a slightly better theme applied on it. Visual Studio and .Net framework tried hard and nearly succeeded to hide the messy roots of the problem but the stench of thousands of leaky abstractions can still be felt every time you open one of the many doors leading to Windows basement. The C/C++ foundation of windows (the shaky ABI) is only making it worse and in my opinion many major problems of modern software can be traced to unsolved problems in C/C++. I have a dream (a delusion :D) that despite the accelerating patches applied to both(coincidence?) of these technologies (C89,99,11,1X C++98,03,11,17 Win Vista,7,8,8.1,9) they will both end in the greatest "oh, f*ck it!!" in the history of software and be abandoned for something much better, which I hope will crystallize out of these ~70 years of computer science.
Could someone explain the difference between: Ethereum, Ripple, and OpenTransactions?
MonoGame: Write Once, Play Everywhere.
Gender Bias and OpenStreetMap – a look at evidence
Some information from the CDC:

http://www.cdc.gov/vhf/ebola/outbreaks/guinea/
RoboVM: Native iOS apps in Java
How *NOT* To Do A Password Field
This is why I always make sure to GC, delete or NULL input variables (you must include the request; body et al.) after encrypt/hash/<mechanism>.

I basically take the stanze that I want as little to do with your real password as possible.
It would still be catastrophic if they had access to the hashed passwords of a big number of users. People use weak passwords and they get cracked in no time if you have just a hash.

But as I said before, that also depends on some details about the setup that we don't know from this article alone.
How Should a Cloned App Be? The Ethics of Artistry in an Age of Exploitation
> CAs must revoke [...]

I understand the word "must" to mean that they cannot add additional strings, such as payment, to their obligation to revoke the certificate. Is there another way of interpreting it that I am missing? I guess you could interpret it as "must provide a mechanism", but I can't see that that was the intent of the original document.

Mozilla's use of the word "must" here I think is important, because the barriers to correctly dealing with a security breach should be minimized. For better or worse, root CA's are entrusted with maintaining the security of large chunks of the internet. Charging users who suspect that their certificates _may_ have been compromised (due to the Heartbleed bug, in this case) will cause users to err on the side of inaction, which is going to weaken internet security in the long run.
Well ... that's disappointing!

As a top-notch surveillance organization in a top-notch surveillance state, I've come to expect more from the NSA. If their job is to protect my wimpy life from those rowdy terrorists, they should be at the forefront of all hacking activities and it's really disconcerting that they didn't introduce the bug into the code in the first place. A vulnerability that big deserves a big brother to protect it.

On a more serious note, the NSA is segmented and unaccountable ... I doubt anyone including the director can make a blanket statement guaranteeing that it has or has not done something. In the next installment of the NSA saga, a reporter with access to the Snowden documents will find proof that this is a lie.
MinGW relies on dynamic linking? I'm surprised at that because when I ran a test just now, Microsoft C++ compiles Hello World to an 84k executable whereas MinGW generates a 261k executable. I always assumed MinGW was doing the right thing and linking statically against (its own version of) the standard library; if not, where does the extra file size come from?
Amusingly, NSA Headquarters address is Fort Meade, Maryland.
I don't agree with not having local repairmen as being a real showstopper. Any new system requires training: fire building, hut building, brick making. They need to factor training into the roll out of the technology, and don't focus on training men, take the women and grandmothers, train them first. RE: The barefoot movement in India: http://www.ted.com/talks/bunker_roy Tell a mother she doesn't have to walk 6 hours for dirty water, she will learn to fix whatever is necessary given the right training and availability of tools/material.
Solved now?
Free and Open Source Software – Missed Opportunity?
I'm in the US.

I guess it wasn't a very good idea to post this question. Its definitely illegal; I was "accessing a computer without prior authorization" (to paraphrase CFAA) to steal data, albeit with the best of intentions. But its good to know that I wouldn't be the first to publish, and that gist is much more brazen than what I was planning (which was just stats and trends.)

I'm going to think long and hard about whether I publish this. I can't really afford to speak to a lawyer. If its that close a call, I'll air on the cautious side.

Thank you both for the assistance, its appreciated.
Any exploitable bug that allows to access private keys should invalidate certificates. There are many security vulnerabilities that don't give access to private keys.
The logic is really not that hard:

Open source software benefits the entire society/humanity.

Therefor, it (or at least the most critical components, such as OpenSSL) should be funded by all governments in an internationally coordinated effort (tax payer benefits = tax payer pays).

If we can have internationally coordinated efforts such as NATO, why can't we have them for extremely important/basic elements of our society such as technology?
Making the borrow checker know about the liveness of variables outside of scope is on the todo list. Like all of the borrow checker, it's fairly tricky to implement properly, but it should be doable. I don't think this issue leaves "a lot to be desired" though; it's a relatively minor tweak on the overall semantics.

Having a borrow check is important, because otherwise you're left with iterator invalidation and numerous other memory safety holes.