skysight-inc/HackerNews huggingface dataset:
If you count up all of the possible states a processor can be in, as well as the number of transitions between them, you'll come up with a very big number of possible execution paths you'll need to verify work correctly. However, if you do the same for the CLI (or any non-trivial piece of software), you'll come up with a much, much, MUCH bigger number. As in, each additional state the CLI can enter potentially doubles the number of possible execution paths you'll need to check.

The number of states and transitions for a processor today is large, but not so large that engineers can't formally and automatically verify that the processor will behave correctly under all inputs. Also, the structure of the processor and the way it is specified (i.e. Verilog) make it amenable to formal verification.

This is not true for most software, not even things written in Haskell. You can cover a lot of cases with automated software testing, but you'll find that it's very, very, VERY hard to prove that you've covered every possible case. Even if you can, modeling multiple instances of the system as they evolve in time (i.e. any networked system or interactive system) means you have to consider all possible combinations of states they can be in.

To put into perspective how hard formal verification of software is, I have a story. A friend of mine did his masters thesis on modifying TCP to allow for host mobility, and formally proving the correctness of his new TCP protocol. Despite having a 100-node cluster of beefy (48GB RAM) compute nodes at his disposal, it simply didn't have enough total RAM to verify the correctness of his protocol beyond five rounds of communication between one client and one server.

Unless the CLI developers add machine-checked but hand-crafted proofs of correctness for each and every method, I trust the processor to be bug-free far more than any piece of software it runs. Now of course, if the NSA tampers with either, then all bets are off :P
Haskell is actually a very fast compiled language. Especially for webservers, where its concurrency shines.
So what are the options then if OpenSSL isn’t fit for purpose? Is it possible to move wholesale to a different project? Are any of them trying to ease migration over from OpenSSL to themselves?
Could have done without the final line though, but I guess it's his equivalent of a signature...
It's not fear of backdoors that make me run a specific router.

If I want free wifi access around the country (via BT Openzone) then I need to run BT's router (which includes the magic to run a separate managed public Wifi access point via BT Fon).

It's annoying, but I can live with it (especially when they get around to upgrading my cabinet to FTTC and I get 60Mbps/20Mbps).
Any basic functionality found elsewhere would be helpful really. It might integrate nicely, but it can't do much past running a script that would take care of everything (build-wise). Variables? Not really. Conditions? Not at all. Final steps? Nope.

Documentation (at least of API) is not that great. If it is available since atlassian's Confluence seems to be down most of the time. The API itself is pretty weak as well. And weird too.. getting an HTML error response on json request? Yay!

All in all, it's one of the worst tools I had to use in the recent years. It looks like a dummy product, just for the sake of it. But at least it's fast I guess. Or I don't get its purpose.
Did you even read the readme.md? 6 lines from the top

"We're releasing this framework because we're excited by the power of this approach for general image recognition, especially when it can run locally on low-power devices. It gives your iPhone the ability to see, and I can't wait to see what applications that helps you build."
Fair enough. Still, it seems silly to name a constant THREE_HALVES. What information does that add over 1.5? What happens if you change it and it becomes wrong?
Could you please upload it somewhere? It's really catchy :)
Good, bookmarked
Just enjoy your work, that's enough :)
I don't think writing bad code is a reflection on the language. You can write rubbish code in any language.
GnuTLS exists. And NSS in mozilla. Probably others too.
FaceDiary?
Because the core idea about the "bazaar" thing that ESR evangelized is BS.

Most people don't have the time or care -- even if they know how to do it. The big push for open source was when companies where sponsoring its development with a lot more paid developers than today (companies from IBM and SUN to RedHat, Corel, Novell, Eazel, VA Linux -- remember them? The bubbliest IPO in history).

That can happen not only for highly specialized code like OpenSSL (which even fewer people can understand), but even for very common and widespread application level code, including projects that one would assume would attract many people.

Gtk, for example, the GUI kit used in Gnome, has just one developer really working on it (I know, cause he complained). Compare that to the 20+ GUI teams companies like Apple and Microsoft, with dedicated technical writers for the documentation et al.
Ask HN: Which TLS implementation do you use at work?
Until today I'd only heard of OpenSSL and GnuTLS.

Wikipedia lists: Botan, cryptlib, CyaSSL, GnuTLS, MatrixSSL, Network Security Services, OpenSSL, PolarSSL, Schannel, Secure Transport and JSSE.

I'm curious to see how much "market share" OpenSSL has given the recent bug, and what kind of operations specifically DO NOT use OpenSSL, in favour of another implementation.
Famo.us – JavaScript engine and framework (Livestream today)
#ironic +1
> single threaded performance, while having taken a hit, is still growing at a healthy 25% per year.

That's false.

Moore's Law used to translate into increased clock rate. In consumer CPUs, this clock rate has stagnated at around 3 GHz ever since 2002 !!! This happens due to issues with power dissipation and increasing GHz count was a waste anyway, because performance increases from higher GHz isn't linear (i.e. a 25% increase in GHz count translates in less than 25% increase in performance and the difference in top of the line consumer CPUs running at 3 or 4 GHz and over-clocked prototypes running at 8 GHz is much smaller than you'd think ;))

Ever since then, single-threaded performance has been improving by design changes (e.g. instruction-level parallelism, caching, etc.), however this doesn't scale and isn't necessarily related to Moore's Law (i.e. the processor doesn't know the code's intention and so there are hard limits to how many smarts it can pull off).

https://en.wikipedia.org/wiki/Clock_rate#Historical_mileston...
Is that really the case? In Java (my native language, so to say) I quite regularly browse through the language library implementation. I found it quite easy to read and comprehend. I almost always learn something new by doing so.

Not so much for Haskell. When I started with it, I similarly tried to learn by going through the language libraries. Even when I gained some more experience (I am still a beginner and only casual user, though) I have a very hard time to understand what's going on. The code is so dense that I find it hard to understand.
Yes go for it everyone. Skew the market even more!
Made for a Marathon: The Science of Long Distance Running
Historically GnuTLS had even more security trouble than OpenSSL (like that bug where it was trusting a self signed root certificate even if not in the certificate store that went undetected for years).

And NSS is pretty light on the server code IIRC...

In my past as professional code auditor, I've seen OpenSSL shipped with products quite a bit, and in 99% of the cases it was openssl the command line tool that was used to access the functionality because yes, the API is that bad and confusing that people would rather pipe to an executable that use library calls...
In my book, 6 months of inactivity is more than enough to make someone irrelevant.
Harper was CA, but I don't think that's indicative of his politics so much as his location. There wasn't a meaningful (federal) PC party in Alberta for him to join. Heck, he was a member of the Liberal party until he was 26!
Puking On The Emotional Startup Rollercoaster
Heh. Alexa.com is on the list.
I'm between contracts at the moment, but I've planned it in.

I can't just work n months of the year and keep happy clients, but I've done 30 months straight for one client. That means I can comfortably take 6 months out now, over the summer months when the weather's better and the days are longer. We can book a family holiday; my wife needs to give 8 weeks notice before taking leave. I'm moving house and will be able to spend time doing the property up.

Personally, having the time out not at my choosing would be quite stressful and wouldn't allow me to plan house moves, holidays, etc. around it. I guess YMMV.
I would assume that csc.exe will compile it on windows, otherwise you will need to install mono
Personally it would be interesting to sue OKCupid for promting the boycott to compel Mozilla to violate employment laws.
I echo what someone said earlier on another OpenSSL thread: security applications should not be handling their own memory at a low level like this. It's just too easy to mess up, and it often leads to the worst vulnerabilities.
No source. I am glad you have a great looking product.
I have, purely because it was easier (in the last few months) to just keep clicking on a button every 14 days or so[1] than to do all the work to find out what free DNS solutions my router supports, updating the configs (or implementing a cronjob/API call) and then finding everywhere I've buried my dyndns address so that it can use the new one.

Of course I'll have to do that work now, but you never know if Dyn will change their mind so I'll hold out until right near the bitter end.

A single IP of my home router just isn't worth $25 a year IMHO. There are plenty of other companies that offer the service for free so I'll just leave Dyn with (a probably undeserved[2]) negative opinion of them for kicking me out.

1. It was hardly difficult, they sent you a reminder each time that contained the link to click on!

2. Not entirely sure how long I've used Dyn for, the earliest email I can find is one about my host expiring back in February 2006.
Slavery in America is something that really needs to be discussed openly and in free society. People believing that slavery doesn't/can't exist in their modern world really need to be exposed to the truth: there is more slavery now than there ever was.
cURL makes a nice comparison: http://curl.haxx.se/docs/ssl-compared.html

GnuTLS had its own problems recently (see: http://www.gnutls.org/security.html), and regarding NSS... I couldn't find a proper public "security" page for it (eg, release notes for 3.16 point to CVE-2014-1492; but the link to the bugzilla issue is not public), so I don't know.

Obviously a good security record doesn't imply things like a good code base, good practices, etc; (although it could).
Can you use a bloom filter against the CRL/OCSP, then test possible matches against the OCSP? I don't have numbers handy, but that could potentially improve privacy, speed, and bandwidth concerns.
Why You Don't Need Investments
At a first approximation, no one should write their own memory allocator. Just as no one should write their own garbage collector, and no one should write their own filesystem.

All these subsystems have one thing in common: they are incredibly complex and very hard to get right, but seem easy on the outside.
2nd gen Nexus 7 doesn't like the SSL cert and removing HTTPS redirects back to that version.

In case the author is reading these comments, that's unfortunate. (Chrome for Android, should be current.)
Well, aggregation in MongoDB allows you to write sql like queries, and before 2.6 if aggregated result was > 16mb it was throwing an error, but now it gives you a cursor. Now you can fetch the results and send to another collection. For an example aggregation query in mongo have a look here: http://docs.mongodb.org/manual/tutorial/aggregation-zip-code...
Amazon EC2 CVE-2014-0160 Customer Security Notice
Because companies are cheapskates nowadays.

Back in the Linux bubble days (1997-early 2000s), lots of companies employed full time people to work on all kinds of stuff, not just profitable company project, but also needed infrastructure. Even front end projects, like Nautilus and Evolution were created by full paid teams.
For the benefit of those who don't know who he is:

http://en.wikipedia.org/wiki/Theo_de_Raadt
Compared to what?

You are aware that GnuTLS had a very similar "goto" style verification bypass bug, and that OpenSSL has had several flaws and broken stuff discovered, including the major recent "Heartbleed Bug".
This was bothering me too. The article goes on and on about resolution and no mention of latency or motion tracking at all. Those are the hard problems.
I like how those bounds checks (the ifs) have no curly braces, as if that Apple security bug didn't wake people up about such trivial opportunities for bugs.
What i would do ?

I would definitely start looking for a job elsewhere.
If he believe that with the talents he has abroad at the 1/3 of your salary he can do what he wants, then you will soon be deemed over-paid.

Getting the raise will be extremely hard, unless you are really core to the company and they will be affected heavily if you leave.

I would start looking for another job that it will make you happy as well.
Not sure which one I'd pick; all of the main libraries seems to either have had very bad issues reported at one point or another or are maybe not used enough to inspire enough conficdence; anyway here is a list https://en.wikipedia.org/wiki/Comparison_of_TLS_Implementati...
fedora is apparently trying to consolidate all crypto to NSS

https://fedoraproject.org/wiki/FedoraCryptoConsolidation
The artists who are giving a human face to the US's 'bug splat' drone strikes
theo's an asshole, but he's quite often right. i don't like his attitude too, but it has to be said that in this particular case, consequences have been - and/or will be - extraordinary.
> Has this sort of behaviour been observed for other vulnerabilities in the wild that can be cited?

Yes. The mailing list that was used as recently as 2011 to coordinate exactly this kind of issue was backdoored.

Further reading: http://www.openwall.com/lists/oss-security/2011/03/03/3
SHA_Update is for the SHA-0 hash, and SHA1_Update is for the SHA-1 hash, so it's hardly completely illogical. The main issue here, is that people that don't know the difference between SHA-0 and SHA-1 should likely not be in charge of computing hashes by themselves. Crypto requires some expertise or it goes awry very fast, but then the educational system is producing plenty people with good crypto knowledge, it's hardly the niche it was only 20 years ago.

Also SHA-0 support is left out if OPENSSL_NO_SHA0 is defined, which must at last be the case in the FIPS version of the library, the one your want to use for regulation reasons in many cases...
A $250 card from 2006 had no problems rendering in 3D @ 1440P at a solid 60Hz. Sure, it couldn't do Crysis 3, but there were games available that ran fine. Android games aren't anything like Crysis, a K1 should run most of them @2560 @75Hz without breaking a sweat.
I Watched Russian State Television for a Whole Day. Here's what I learned
Off topic: I wish, there would be a practical way to program for neuromorphic chips, which are inherently analog. Anybody have some idea or links regarding this field?
The Casio G-Shock DW-6900MF
The Casio GShock DW-6900MF models feature a metallic finish on the case and band, and a colour mirror LCD. Get one for only $89 at http://www.casiosolarwatches.com/watch_promotions_and_discounts.html While Stocks last
Thanks! (I'm representing the author of the piece) - there's most certainly a lot more depth to how the brain tackles all this chemical activity, but we thought a simplified explanation would be the most useful for people to try and solve the problem.
Glad you liked it! Wishing you the best with trying to implement the small changes :) (representing author of the piece!)
> http://www.hokstad.com/the-problem-with-compiling-ruby

I wrote that one in frustration when working on my Ruby compiler project, actually, and I think there are reasonable solutions to all of them, and in fact you will find that most of them, possibly all are solved to various extents in either Smalltalk implementations or Self implementations. In particular the Self papers is an invaluable resource for anyone who wants to implement languages as dynamic as Ruby, or Javascript...

The main problem is the effort. And implementations like MRI really has not tried very hard to address any of this - you'll note it first got a bytecode version (instead of AST walking) with 1.9, and still does not JIT. AFAIK they've not even tested simple optimizations like partial vtables to avoid the costly method dispatch etc.

A big part of the challenge is that Ruby is a remarkably hard language to implement, not just or even mainly because of the dynamic features - those make it hard to make it fast, not hard to implement - but because it's still largely unspecified, the parsing is chock full of annoying corner cases, and there are lots of dark, hairy areas of Ruby that almost nobody ever see. I love Ruby, but I think it badly needs
a revision that deprecates a whole chunk of functionality that nobody really uses but that affects implementations, as well as writing a proper spec and then tighten up a whole lot of areas where users would be largely unaffected, but that would make it vastly easier to implement.

So a lot of effort that could have gone into making implementations faster, go into addressing annoying digressions.
It's not something I work on. But clearly a lot of other people do. And I have some trouble believing that all those people building stuff on top of OpenSSL don't care about security.

Look, if this was about something fairly inconsequential, like a library for a game or a blog or something, sure, use some badly maintained, badly documented, inconsistent library. But when you care enough about security to use SSL, surely you care enough to use something that's put together in such a way that you can be sure it does what you think it does? Bad documentation and inconsistent error handling in a security package sound like an unbelievably dangerous idea. And if it's really an unmaintainable mess, like everybody says, then how can bugs possibly be fixed? How easy would it be for the NSA to insert some crucial vulnerability into the code base?

Security, moreso than anything else in computer science, needs to be clear, transparent, understandable, well documented and well maintained. If it's not, mistakes will be made and security will be compromised.
PolarSSL is used by the OpenVPN-NL variant of OpenVPN that has a Dutch government 'seal of trust' attached to it. They require you to use OpenVPN-NL (instead of regular OpenVPN) for various purposes. They have issued a statement on their mailinglist that they (of course) were not vulnerable.
That page has not been changed since May 7th 2013, I am not sure that this is currently still actively pursued.
Also I haven't seen this on the proposals for F21
Unity only uses C# for application-level user code. The core engine is C++.
All protocols are full of cruft like that. It's not that different from the Bitcoin "malleability" attack which also originated in a feature that has no practical use but the protocol designers thought might be handy to have in the future. Many people think it is a good idea to build extension points into your systems because that increases the flexibility of it. In reality it just makes the system harder to use and more prone to bugs.
None of the techniques that's gone into V8 are all that novel. Most of them - at least the ones that are relevant to Ruby - stems from research around Smalltalk and Self that's been well known for a very long time. The hard/time consuming part is implementing them.
What does kindness get you? This.
I always felt like there unfortunately was no proper alternative to libopenssl (might be unfair but it seemed like a somewhat smelly library) but thanks to this event I've now been made aware of all the alternatives.

How much more fun/comfortable is NSS/GnuTLS to use in a typical C project in comparison to OpenSSL?

Great potential to learn for developers and users alike this heartbleed.
This is good stewardship by Linus, yet once again. It makes no sense to just jump on this feature without community support - and that means testing, refining, analyzing the plusses/minuses in moving to this optimization level.
The version at pastebin.

http://pastebin.com/HMUjbnnN
yeah, why not rename this to NSASSL
Perhaps this task should be moved away from libraries (which in some cases are even statically linked and hard to update) into a well-audited daemon, written in a safe language. Or even into several separate daemons for better protection (each with the least privileges required and minimal interface), for example one for handling keys / signing requests only.
I cant view anything meaningfull on mobile device. Had to wait till I viewed it on desktop.
What exactly is ‘the mobile web’? (and what does it mean for web literacy?)
If this post is truth, its a shocking condemnation of open source custodianship of security software.

Im shocked, dismayed and disheartened.

OpenSSL if still maintained by these folks should be wholesale deprecated in all versions and forever more.

Over and out.
Officially at work software engineer, but I will let others call me "Lord".

When freelancing, people state I am a web developer / application developer, but I will let them call me "God of development".
I hate to chip in on matters i know nothing about but that contract looks suspiciously one sided even for someone who knows nothing about this situation.

As in something only a trusting gullible person would sign based on a verbal agreement and without consulting a lawyer.

2 years unable to work without your previous employers permission? Holy shit is that even enforceable?

He definitely got screwed to what degree I don't know.
And why are we making excuses for a excuse me fucking idiot who wouldnt bounds check a goddamn len??? In SSL?

What are we a bunch of pretentious fucking children who forgot how to code?

Untrusted input HELL fucking LO!
> Reasoning about a smaller code base is nonlinearly easier.

I agree.

The effect could be offset by having to reason about the implementation details of a more complex platform though.
Transitioning from Print to Digital. A Designers Perspective.
Gamification: The Key to Re-Engaging High School Dropouts
That makes me wonder - have you ever tried to build products as part of the company, or have you always kept it strictly consulting?

Many, many of our fellow consultancies here have a plan of "consult now, while we build a product" and I'm wondering how prevalent that is.
Has anyone started a rumor yet that the NSA infiltrated the OpenSSL development team to make OpenSSL ineffective and full of holes?

The convoluted code of OpenSSL alone (from yesterday's Hackernews post) seems like a great way to add all sorts of "bugs" inadvertent or not.

Unfortunately with the Snowden disclosures, there isn't much that I rule out of bounds for the NSA when it comes to things critical to internet security. OpenSSL is so widely used and critical, it would be silly to think that it would escape scrutiny by the NSA.

Remember that the Snowden docs says that the NSA can break SSL/TLS/https/VPN, etc., but we do not know the full details: http://blog.cryptographyengineering.com/2013/12/how-does-nsa... But the one thing all of these technologies (SSL,TLS,https,VPNs) have in common is usually OpenSSL.