skysight-inc/HackerNews huggingface dataset:
HMO: Help Me Out
I just read this [1] post, and I think we can do it at a big scale here at HN.

So, if you need any help with a project, a startup, or an idea, just post it here. Mention any details that might be required, and make sure to add contact details!

Let's see how we can get some good rolling here.

[1] http://tomcritchlow.com/post/82380207991/let-me-know-how-i-can-help
Exceptionally long passwords can be difficult to type accurately. Probably most on HN are good typists, but still I find entering long passwords error-prone and frustrating.
USA has SOCIAL contributions - FICA, SSI, Medicare. That's retirement, care for disabled and elderly. Our schools ARE free. It's easy to add up my healthcare insurance which isn't much - $250 per month - less than 2% of my income.

The chart INCLUDES NYS tax. Source of that charts:

http://www.businessinsider.com/america-taxes-charts-2013-1
On that subject, https://news.ycombinator.com/item?id=7572414
I have not seen any comment by the security researchers about why they choose to disclose to some organizations (such as cloud flare) earlier than the general public or the distributions. Perhaps, they felt the need to have some organizations with very large OpenSSL installations test the patch prior to make sure it worked and did not cause any unexpected problems?
It seems like a "feature" that you'd want your process to store the private key material as low as possible in the address space so that arbitrary read overruns don't run the risk of hitting it. It seems to just accidentally be this way in nginx, but I wonder if it should just be another (tiny) layer in the overall security design.
Ask HN: CMU or Berkeley – Co-founders and Startup Internships
I was admitted to the School of Computer Science and the Tepper School of Business at Carnegie Mellon, and the Letters and Science department at Berkeley which offers the Computer Science major. Which school would be the better school to look for co-founders (quality classmates), and startup internships (location?)? Here's my breakdown right now:

Berkeley:
1. San Francisco is the right place to find work at startups
2. Large, diverse student population

CMU:
1. A high quality student population (co-founders)
2. A high quality CS education

I know this is under the assumption that I'm competent enough, please leave constructive comments :-)
There's no reason for an audiophile to test if the part is genuine. They would need to buy a "genuine" part to compare against, but that presumes knowledge about the original part being fake.
Especially since this request was done by snail mail, so the passport was probably a black-and-white photocopy. All the attacker needs to alter is the name, which seems pretty trivial.
Is there much difference between KeePass and KeePassX? I'm assuming the latter is a bit more cross-platform friendly?

I use the former, since I'm on Windows, and use VMs for any dev related work. KeePass seems to have a good system in place for synching versions. Using GDrive, if I edit my pass on one machine when I try to add a new password from a second machine I get prompted to either Sync the file first or just completely overwrite it. I've yet to encounter an issue where KeePass gets confused as to what's changed and end up losing passwords in the process.
> I'd hope they remove country based discrimination in EB visas. And better yet pass immigration reform sooner rather than later.

What country based discrimination? The quotas are to prevent two countries from flooding the immigration markets and making sure diversity exists.
Hi there, my gf works for a recruitment company who's helped quite a few developers from outside the EU find work here. Drop me a message at davedx@gmail.com if you'd like me to pass on your details.

FWIW I work in a room full of Russian speakers at the moment. I quite like the atmosphere :)
I have signed a Copyright Sharing Agreement with them...

They only accept copyrightable contributions from people with that agreement (as far as I know)..

As typo fixes, small bug fixes and one-liners are not considered copyrightable they accept those without it..
> a new generation of web forms

* sees a carousel*

/facepalm..
> shutting down 'dissenting opinions,' ever since the Ukraine conflict started

Much, much earlier.
That's desirable for Amazon, too.

This program gives them some control over when someone is likely to quit. I.e. not in the middle of a holiday rush.
Yes, that's exactly my situation. On the outside it looks like you are not active, but actually you are regularly on twitter.

Unfortunately, there is no way to measure this case, except for counting the people you follow or the people who are following you. Then you could know whether that user is somewhat active.
Oh I get the context, that's just not what the article is meant to confer. :)
> the stupidity of the developers behind said exchanges are the sole reason

Exactly. The fact that they picked MongoDB for this application in the first place tells me that even if they used an ACID-compliant database, they still wouldn't have known to use transactions, and would be vulnerable to the same attack.
'Higher level' doesn't necessarily say anything. Rust and ATS are both higher level than C, but they can both do everything that C does.

Is Ada less performant than C? I know it has bounds checking, but that can be turned off for "shipped" software. Does it have some features that incur a runtime cost and that can't be disabled?
Hard Questions Spark Breakthrough Business Thinking
You can guarantee the heap will not be touched in any code that:

- does not use malloc or new
- does not call any function that uses malloc or new

When you do that, you make allocation decisions orthogonal to the algorithm. This is how all the std algorithms are implemented.

Haskell also separates allocation from algorithm, but it so by making decisions for the programmer -- by using GC. This is not an acceptable trade-off for a C++ developer or else she would be using a different language (or smart pointers).
This is genius. Many people feel stuck in jobs they don't like for financial reasons. They're surely not as productive as they could be if they were happier. Providing even a small bit of assistance to help them out the door helps both sides. Employees don't feel trapped and employers don't have to wonder if their employee is just have a rough time or if he/she does not want to be there any longer.

Not to mention, as another commenter pointed out [1], once you decline the money you will look back and remember you made the decision to stay when presented an opportunity to leave.

1. https://news.ycombinator.com/item?id=7572688
Found this among the returned data: http://cl.ly/image/2o391V1T2R46
Who would request that much lorem ipsum nonsense and for what purpose?
Can you explain what that means?
This, and a thousand analogous reasons, is why gay marriage matters.
Do not miss 21 User Activation Hacks
Some people think that acquisition is the most important part of the funnel, but the truth is that getting visitors on your website is just the first step – you need to focus on later stages of the funnel just as much as the first one.

Activation is the process of turning your visitors into users that stay on your website and perform an action – not just any action, but precisely the action you want: leaving their email address, buying or simply clicking a button.
I seriously don't expect anyone will find anything (reasons mentioned in the blog post), but that doesn't mean I haven't pointed my exploit that searches for private key material in the return buffer at it on a one second interval. If anything I suppose CloudFlare will be able to produce some pretty pictures of the amount of incoming heartbeats they received!
Oh, that's great news! Unfortunately I'm on other projects now and likely won't have a chance to reevaluate in the short term, but I'd like to take a look at some point.

GnuTLS was not the most pleasant API to use, but it did hit some very impressive throughput numbers in our use cases, and seemed to deliver on the theoretical promised instructions/byte that Intel talks about in their whitepaper(s) about AES-GCM.
Sorry I can't really provide an intro but I'm sure these guys could answer some of your questions. (they seem like good people)
http://www.artsicle.com/
Granted. Code reduction on the other hand is generally a good thing. :P

I want to say that I would have done the same thing. At the same time though... doing so with a security application assumes that the team supporting the software you depend on is competent enough to properly audit and test their code.

I have a feeling that OpenSSL will be leaving a bad taste in peoples mouths for a while. :/
Flickr is still unsafe
Aren't H1B work visa? But I think your idea of the green card is pretty good to return the balance of employer/employee leverage. I wonder what abuses that might have though.
I think think the thing about Twitter is you essentially have to pretend you have a network to actually gain a network. You have to do the internet equivalent of putting yourself out there, because if someone gets to your profile and sees you have no tweets, they probably won't follow you. Its definitely a Catch-22 scenario, but things like retweeting and favoriting can help you build that network without doing stuff that feels too weird. Also using Twitter as a networking tool on top of real life is definitely helpful, as people you meet in real life will probably be more willing to engage with you on Twitter.
Link to the whitehouse factsheet announcing this:
http://www.whitehouse.gov/the-press-office/2014/04/07/fact-s...

Relevant excerpt from the section "Attracting the World’s Best and Brightest":
These proposed regulations include rules authorizing employment for spouses of certain high-skill workers on H-1B visas, as well as enhancing opportunities for outstanding professors and researchers.

As to what certain means remains to be seen.
Nope, I once got in trouble for playing a game of Spades in school during a non-class period. Today I don't gamble with card playing so I cancel you out and invalidate his point.

Wait, unless his point was that you like card games, gambling or otherwise. If so, you're on your own.

Good luck!
India and China are vast countries, the diversity should also take into account population/area of the country on which limits are enforced.
They didn't have root, they had whatever user the XML parser was running as.
til; that resistors are trimmed with lasers http://en.wikipedia.org/wiki/Laser_trimming
Hmm, I'm in Canada, and while the legal minimum here probably isn't much higher than the US, maybe companies tend to offer more. Could just be what I've heard of in the largish engineering companies I've been in.
A College Degree Does Not Make You a Million Dollars
It seems counterproductive to the point of welfare to have the people who need welfare pay for it. It isn't an insurance policy.
The test's restriction on consulting material from websites and books, excluding the official reference documentation boggles my mind. Unofficial 3rd party documentation is standard kit for a developer, especially when using community driven programming languages.
If the offer is annual and they add an extra $1000 per year then on average the disgruntled employee has to wait 6 months to quit and get a higher severance, not 1 year. Which means that 1/4 of those employees only have to churn through 3 more months to get an extra $1000, hardly something nobody would do.

The obvious solution to fix this flaw in the system would be to raise the offer daily instead of annually, be approximately $1000/365 =~ $2.74 per day. Or more simply by $20 per week, which comes out to about the same per year ($1040).
It's shocking to me that baking "db creds" into a binary or configuration file is still so common that anyone would expect it to be true on a randomly selected server. Is this still the industry standard?
I like to think of it as Lawful Evil ;)
You're missing the point that every pretty much every organization has people hanging on because they need the money, this is incentive to get some of those people to move on, not to eliminate the possibility of employees ever hanging on for a little bit more money.
The example is too trivial. you could have 100 ways to write "hello world", but it does not matter.
That works up until it doesn't. Telling n people can work great, telling n+1 people may be complete failure, worse than telling none at all.

It seems (barring evidence saying otherwise) that CloudFlare managed to keep it secret while working on it, so they were proper to have in the n.
I thought I will share my idea of unique, memorably passwords. I have a custom in-head hash function that I use to create a unique password for every single website where I have an account.

It works as follow, let's assume this is the domain we try to generate the password for:

www.example.com

The hash process:

1 - take first letter, move 2 in alphabet, capitalize - 2 places after e in alphabte is g ("abcdefg"), capitalize - G

2 - calculate number of words in domain, x2 = 7x2=14

3 - use standard salt - eg. tlpWENT2m

4 - take last letter - e

That leads to a password:
G14tlpWENT2me

Which is both easy to remember and allows you to have a unique hashed password for every website around.

Have fun with discovering your own hashing method.
Long before the music store existed, the iPod was entirely different than other MP3 players of the time.

When I got the first iPod, I also had a Creative Nomad player that had a little more storage and a search function. However, the iPod on the other hand had Firewire rather than USB 1.1, making it a painless process to add and remove songs right before you go somewhere, rather than a hours long process you had to plan in advance. Even more importantly the scroll wheel on ball bearings with made it feasible to fly through a tree of artists and albums with thousands of audio tracks.

The shift in convenience was on the level of shifting from a phonograph to a cassette tape, except that records are more convenient in some situations.
The trimmed resistors are the four brown rectangles with notches (one is shown in atomlib's pic).

The silvery surfaces are aluminum - seems a single layer of metal process. Some large plates may be capacitors.

In analog circuits, MOS transistors are often fairly big, to carry larger currents, sometimes in the tens or hundreds of milliamps. There are a few such large devices, where you can see an interdigitated structure: think two hands open flat with the fingers interpenetrating but not touching. One hand is the MOS source terminal, the other is the drain terminal, the space between is the gate that controls current flow in the channel between the two first terminals.

(Layout diagram picture: http://pages.cs.wisc.edu/~butts/icons/ex2.gif - blue is metal drain and source, red is poly gate, green squares are contacts to silicon below.)
Considering the 1% rule of Internet culture (only 1% of the users of a website actively create new content, while the other 99% of the participants only lurk), 44% sounds quite good.

Sites like Twitter and reddit (and HN, to a lesser degree) probably get a higher proportion of contributing users than your average forum or Q&A site by lowering the barriers to contributing.

Reference: http://en.wikipedia.org/wiki/1%25_rule_%28Internet_culture%2...
Yes, as long as you don't distribute it. Using GPL software in your website without sharing your modifications is fine, but selling copies of the software without sharing your modifications is not fine.
There's no way to share such a bug with the major Linux distros and let them deploy a fix to users without making it public at the same time. Even assuming that the distros commit to handle the fix submission and silently repackage openssl (which they don't always do, depending on their policy), the word would get out minutes after it's pushed to the update servers.

So telling major Linux distros == telling the public. At this point, you have to decide whether you want to forewarn big hosters handling millions of sites and billions of visits like Cloudflare, Google, AWS, etc., or not. I don't think there's a good universal answer to this.
I am not starting a another language war.

Just stating the fact that when someone posts "C++ is horrible because of X", that X is either also available in "ANSI C", caused by compatibility with C semantics or compatibility with C toolchain.
I had the same thought. I find it odd he didn't mention them.
Is that why all the board games from my childhood had those stupid spinners that eventually stopped working? That's just crap.

No, that's just stupid, could you not gamble with a cardboard spinner?
Hi! In fact, that's exactly what we do at Detectify. Just check out https://detectify.com!
MJOLNIR?
Using twitter just to consume information is perfectly legit
Is it admirable when someone does the right thing for the wrong reason?
FTC clears Facebook’s WhatsApp acquisition – with a warning
Crudely:

1. There are good and evil, only. The role of good is to fight evil, using violence.

2. The origin of evil is either irredeemable people or irredeemable ideologies. They cannot be reasoned with and do not have internal logic. The only way to end evil is by force.

3. Wishy washy good guys negotiate, but it never works. Manly good guys shoot first. That works.

4. If you are not succeeding with violence, use bigger, shinier violence.

5. Violence solves the problem, and once it's solved, it's over, and everything goes back to happy.
Here is a Google tech talk with Eric Ladizinsky that got posted a few days ago.
https://www.youtube.com/watch?v=eIEy1KHk0rk

Very interesting listen if you have the time
In which we learn that there is not such thing as non-bias. Whether de facto or de jure, there are always biases. Either a person chooses them, or nature chooses them. There is no universally "fair" distribution over a scarce commodity.
Just as a side note: if you're looking to write a convenience wrapper like the author's transformVec, do not have it take the function as `const function<T(T)>&`. Instead, do something like:

template <typename T, typename F>
vector<T> transformVec(const vector<T>& v, F op)

Using std::function in a case where you just want something callable just makes the optimizer's job a lot harder. Using std::function is a good idea if you actually need type erasure (for example if you want to pass something callable to a function that is not a template).
this is a bit worrying, the news article claims that these are still active users regardless but as far as I know, I get random tweets from bots and strangers promoting their own thing and largely I don't have a very active engagement with Twitter.
Voluntary redundancy offer is pretty widespread. But there is usually exception for developers and other highly qualified people. Devs cant quit :-)
'certain' in this context means: those H1B holders who have completed 6 years of the original visa term. They are compelled to either wait and languish in line, or go back home where their spouse can work.

Edit:
Not sure why I got downvoted. I was just paraphrasing the reasons given in the proposal. Its not an opinion. Don't shoot the messenger.
See http://www.reginfo.gov/public/do/eAgendaViewRule?pubId=20131...
> India and China are vast countries, the diversity should also take into account population/area of the country on which limits are enforced.

It is not clear to me how having a diverse country that is not dominated by immigrants from one or two ethnicities arrives from letting this happen. Or how it is fair to the guy from random tiny country X when he has to compete against two largest sources of immigrants to this country.
Sure, but there is continuum here. It's not a binary decision.

For example, I consider the sublanguage in printf to be more declarative than the rest of C as well.

SQL as it stands, especially in contrast to what the existing models were at the time it was introduced, such as CODASYL.

SQL is the one language we use that somewhat operates at the level of thought.
Just to clarify:

a) You're suggesting that we start an HMO meme on Hacker News which clearly means "I'm looking for help, this is what I'm looking for help with"

b) This post is the first one and it's your list of things?

If so: Cool :) I can't help with any, but I thought that this clarification may help others.

I was also wondering to myself: would this be a good idea for a monthly thread a la Jobs/Freelancers/Open Source? I decided that it probably wouldn't be, because you'd end up with a difficult-to-read list of things that people may or may not need help with.

Articles like Tom's which include specific requests are probably the best format for such things. We don't want any information overload, right?
> I think there is an important and quite general point here: it is not just about programming languages, but also about programming knowledge and skills. You are replying to someone who was unaware of the state of the art in program verification (to be fair, he recognized the issue to be solved, which is an important start.)

Well let me be clear that I knew of program verification because I'm a PL geek, not because of any skill whatsoever.

> Not everyone will be capable of making the switch, and for an organization to simply say 'from now on, we are going to use this safe language', without addressing the skills issue, is setting up for failure.

Well, let's keep the discussion to programmers who really need the things that we are after - safety and efficiency. It's not all programmers, just programmers in some domains. Some people might even think that some people can't adjust to writing low-level code ala C, period. But some domains need these things, which means that we just need the programmers who are motivated enough/have the patience to learn it. Just those programmers, not all programmers.

If we can't get them, then maybe some one will actually have to offer some incentives like money - instead of a purely volunteer effort as I think was the case in this debacle. :)
No that's not what this policy does.

For the sake of argument (and simplicity) let's say that schooling and other childhood / early adult expenses for the average citizen cost the state $100,000, and let's say that in return the state is likely to gain $200,000 in tax money back from citizens over their lifetime once they become productive members of society.

It's pretty obvious that if you give adult immigrants who can immediately become contributing members of the economy a 1/3 tax discount that the state loses nothing, and only stands to gain from the deal, since they never had to pay those $100,000 to send them to school as children, that cost was offloaded to some other nation-state.

The tax contribution of those immigrants to social programs like welfare is also going to be just the same as the contributions of native citizens, despite the lower tax rate, because the state isn't also using that tax money to pay for those $100,000 it never spent.

If anything the flaw in the Dutch policy is that the tax discount isn't large enough, should last for more than 10 years (i.e. indefinitely, and should be larger if you promise to get out of the country before retirement), and that they should offer it to more immigrants, not just the highly skilled.
`result = [i * i for i in v]` looks much more readable to me.

What if you need to square every other element? copy_if and transform then don't look so pretty anymore. `result = [i * i for i in v if i % 2 == 0]` is still more readable.

What if you need to do something else and you don't know if there is a transform like function for it?
It's all true, but then again, everything would be better if we'd start from scratch today. Compromises made to tip-toe around technology limitations are what adds complexity to most of today's software, but even tomorrow's software will be influenced by today's limitations. It's best not to dwell on the past.
I think what the parent implies by "work visa" is a visa that is not tied to the employer. The H1B as it stands now is just a proxy for indentured labor.