skysight-inc/HackerNews huggingface dataset:
Read Spolsky's Strategy Letter V[1].

All else being equal, demand for a product increases when the prices of its complements decrease.

Internet access complements all of Google's other products. It is in their interest to commoditize it even further and make it cheaper. If I were Verizon and Comcast I'd be worried.

1: http://www.joelonsoftware.com/articles/StrategyLetterV.html
Show HN: PostgreSQL LISTEN Exchange for RabbitMQ
> C exported pretty much every abstraction of the underlying instruction set, but not coroutines.

My hunch is that the designers of C would have said "goto" and "switch" cover the use case where you have a bunch of peer chunks of code that you want to freely bounce between.

Remember, at the time function calls were considered expensive, so not support full coroutines across function call boundaries may not have been on their minds as much.
Does Musk’s Gigafactory Make Sense?
Here was our initial conclusion from the CloudFlare post you referenced:

============

We think the stealing private keys on most NGINX servers is at least extremely hard and, likely, impossible. Even with Apache, which we think may be slightly more vulnerable, and we do not use at CloudFlare, we believe the likelihood of private SSL keys being revealed with the Heartbleed vulnerability is very low. That’s about the only good news of the last week.

We want others to test our results so we created the Heartbleed Challenge. Aristotle struggled with the problem of disproving the existence of something that doesn’t exist. You can’t prove the negative, so through experimental results we will never be absolutely sure there’s not a condition we haven’t tested. However, the more eyes we get on the problem, the more confident we will be that, in spite of a number of other ways the Heartbleed vulnerability was extremely bad, we may have gotten lucky and been spared the worst of the potential consequences.

That said, we’re proceeding assuming the worst. With respect to private keys held by CloudFlare, we patched the vulnerability before the public had knowledge of the vulnerability, making it unlikely that attackers were able to obtain private keys. Still, to be safe, as outlined at the beginning of this post, we are executing on a plan to reissue and revoke potentially affected certificates, including the cloudflare.com certificate.

Vulnerabilities like this one are challenging because people have imperfect information about the risks they pose. It is important that the community works together to identify the real risks and work towards a safer Internet. We’ll monitor the results on the Heartbleed Challenge and immediately publicize results that challenge any of the above.

============

Which is exactly what we did. To be clear, we were wrong. Our mistaken assumption was focusing on the private key itself and not focusing enough on the exponents that are used to generate the key -- which is what the researchers who solved the challenge were able to obtain. As the wishy-washy conclusion above hopefully makes clear, even when we said it was hard to get the private keys, we were very uncertain and uncomfortable with that conclusion. That's why we posted the challenge. What the challenge did was answer the question definitively: you can get private SSL keys. Knowing that has been valuable for us in deciding to accelerate reissue/revocation process for all the certs we manage on behalf of our customers. Remember: at our scale, revoking hundreds of thousands of certs risked breaking our CA partners' infrastructure, so it wasn't without a cost. Knowing the risk is higher than we originally thought accelerated our efforts which will be complete in the next 48 hours. And, beyond CloudFlare, our hope is knowing the risk is real and proven has benefited other organizations as well.
In a post-Snowden world the assumption is now that any vulnerability shared with a government is fair game for the government to use offensively.

It wouldn't surprise me if plenty of people who would have previously reported a vulnerability to the government or local CERT are no longer willing to do so.
I found this in the comment thread under the recent post on writing a kernel. I think it was Terry himself that put up the link there. The amount of work and knowledge required to do what he did is just astonishing.
First Graphene Audio Speaker Easily Outperforms Traditional Designs
I thought this would be an article about setting up PPTP and/or OpenVPN on a low end VPS. For anyone doing this for the first time, these shell scripts may be helpful:

https://github.com/cwaffles/ezpptp

https://github.com/cwaffles/ezopenvpn
I published a few pipes -- enjoy! http://pipes.yahoo.com/pipes/person.info?guid=W4YBIUCXEVLHMS...

They're all quite simple. The most complex one uses the "parse location into lat/long" Pipes feature to automatically find me jobs in the Los Angeles area.
How Chromium did not get prior word from Google?
Algebra and Cancer Research
We won't ever run out of oil. What will happen is that oil EROEI will drop and cost will increase until other sources of energy are more cost-competitive and oil becomes obsolete. (... OR if other sources cannot replace oil, economic collapse and demand destruction until demand equals supply.)
> Second, if you invest that $8,000 at a conservative 6% annual growth for 30 years, you end up with $670,000.

Point taken that a significant four-figure difference is enough to make a substantial contribution to accumulated wealth when regularly contributed and compounded on over multiple decades. Nobody should sneer at the power of diligent saving and compound interest (or, for that matter, at college tuition to grow faster than either inflation or your 529 plan :).

That said, the original sentence that kicked off this subthread was talking about a 10 year time frame:

"A 30-year old engineer making $120,000 a year should become a millionaire easily by the time they are 40"

And by the time we got to where I commented, someone seemed to be believe that $88k vs $80k post-tax might make the difference in whether or not it's true that one could be a millionaire "easily" in a 10 year time frame.

The answer, as far as I can tell, is no... uless you can live on $16k and invest the rest. It seems to me it takes roughly $72k invested annually at 6% to make you a million in 10 years.

(I'm aware that it's possible to live on $16k per year. I've done so in the last five years. But not while working full-time in metro California.)

> First, it was a 20% difference

So, a person with $4,000 left over at the end of the year instead of $3,200 should be just as excited as someone with $40,000 instead of $32,000, I suppose. :)
Something something NSA TAO something.
Bitcoin promoter Shrem indicted in NY for money laundering
Committing suicide is actually very difficult. All humans have a strong will to survive, which is always present, even if you are suicidal. Additionally, a painless, nonviolent suicide needs a lot of preparation, which isn't exactly easy either if you are lethargic.
I've been reading So Good They Can't Ignore You and there's an interesting section on this phenomenon:

“The Baffling Popularity of Randomized Linear Network Coding

As I write this chapter, I’m attending a computer science conference in San Jose, California. Earlier today, something interesting happened. I attended a session in which four different professors from four different universities presented their latest research. Surprisingly, all four presentations tackled the same narrow problem—information dissemination in networks—using the same narrow technique—randomized linear network coding. It was as if my research community woke up one morning and collectively and spontaneously decided to tackle the same esoteric problem.

This example of joint discovery surprised me, but it would not have surprised the science writer Steven Johnson. In his engaging 2010 book, Where Good Ideas Come From, Johnson explains that such “multiples” are frequent in the history of science. Consider the discovery of sunspots in 1611: As Johnson notes, four scientists, from four different countries, all identified the phenomenon during that same year. The first electrical battery? Invented twice in the mid-eighteenth century. Oxygen? Isolated independently in 1772 and 1774. In one study cited by Johnson, researchers from Columbia University found just shy of 150 different examples of prominent scientific breakthroughs made by multiple researchers at near the same time.”

Excerpt From: Newport, Cal. “So Good They Can't Ignore You: Why Skills Trump Passion in the Quest for Work You Love.”

His thesis on this is basically that these discoveries depend on a lot of other things occurring first and that once those things have occurred, anyone looking in the right place will see it.

With all of that said, I remain skeptical, at least in the Heartbleed case (they're just SOO close together). tptacek has more experience in these things than me of course, so I'll defer to his thoughts.
Storm is a framework for coordinating computation. It's not really designed to "perform automated tasks for you online" - although of course you could make it do that.

If you want to run a machine learning algorithm on 100 machines then Storm is what you want. Want a service to check the weather for your location? Huginn looks good.
You don't need so much RAM for a VPN sever with a few users. You can get by with 128MB (or even less if you're ruthless), and get such servers for $7.50-$15.00 per year.

Check out:
http://www.lowendstock.com/
http://www.lowendbox.com/
http://www.lowendtalk.com/categories/offers
I have a pretty complex tax life, I know many accountants and tax lawyers, my uncle was an Auditor for the Auditor General's office, my mom used to work for the CRA, I've spoken to them multiple times.

Every single interaction with them and every single person I know that has to deal with them has been nothing but mindblowingly professional. Even on the phone, they are exceptionally good at getting to the point IMMEDIATELY but without the normal "this isn't the right department" BS that every other Canadian government agency has.

It's hard to even think of a number two. The Supreme Court maybe? Elections Canada? Ellis Don?
My concern isn't that they bypassed the middle man; in theory that could be a good thing in the long run. I'm more concerned about Comcast becoming the arbiter of who gets access to their network, and how much that access will cost. By classifying the Internet as a utility, Comcast has to standardize access (again, in theory).
It's not often I see an HN thread which so aptly demonstrates the exact effect under discussion.
What part do you actually disagree with?

If you have two persons with the same body mass, both of them drink 1 liter of whiskey. I bet in one case it will be 'really bad hangover' and in second case it will be 'suicide attempt'.
Being a security consultant involves rather less hacking then you might think it does. I'd strongly suggest talking to Thomas or whatnot and ask what goes into selling and delivering an engagement. Just like you shouldn't buy a restaurant just because you like cooking, don't get into security consulting just because you like the idea of doing security research.

Also, SQL scanner on a site you have no relationship with is both a) really freaking obnoxious, b) potentially dangerous, and c) potentially civilly and criminally actionable.

If you want practice on doing security research, the Stripe and Matasano CTFs are really good. Other options include "Pick the 2nd or 3rd most popular OSS application in your favorite ecosystem and start reviewing the code for the top 10 OWASP vulnerabilities." Spend two weeks on that and you will find Horrible Things.
Really? If there are caveats or disclaimers, they are very well hidden.

For most people reading this actual article, I think they will come away with the impression that it's a complete account.
Technically, you're right, but practically you don't have to give up much to write C99 that is also valid C++11.
Too bad Windows 8 isn't supported, so Truecrypt loses much of its appeal to Windows users.
Ninefold – yay or nay?
I mean that suicide is perceived as something to prevent, but I don't often see the conversation about _why_ we are preventing it. Clinical depression is a beast, and many people who pursue treatment seriously continue to struggle with it their whole lives. I think great minds like David Foster Wallace prove how persistent depression is. Suicide is a real escape from the incredible pain that depression can cause, yet we continue to culturally perpetuate the taboo of suicide. The question is; Why is it not okay for people to kill themselves?
Have you maxed out your IRA before tax day?
All these large tech advertising companies like Google and Facebook talk about huge untapped emerging markets, about moving internationally. Yet these emerging markets lack a very critical component: infrastructure. Yeah, great you want to expand the reach of your ads to new countries but most of those developing countries(3 billion people) still use feature phones and mostly with voice/text.

So why would they wait for the infrastructure to be built?

Google can fly a fleet of autonomous, artificially intelligent, solar powered mesh-connected internet drones across a wide geographic area(wider than what traditional telecoms can offer) offering faster(albeit likely slower compared to developed markets) and cheap internet. It'll practically run itself. They then can turn around and license these drones to the governments of those same developing markets where internet maybe slow or nonexistent or too costly to build in traditional ways(laying pipe, etc).

It's brilliant and potentially a huge money maker due to their, again, first-mover advantage. Facebook had it but blew their cash on da Rift.
I gave up using SOCKS, and now just use SSH to map a local port to a remote squid3 instance. This way my DNS queries are done on the VPS, and aren't subject to interference by my ISP.
I wonder how much power we could generate if we really have an affordable solar panel for everyone to use, put a giant sheet of panel up in the space, storing mechanical and wave energy as we walk, drive on the road and move things around the house, convert organic waste (human and animal poop) into energy.
This seems very one-sided and does not address real issues. If you don't address key issues around expectation setting, common goals, etc then yes these may occur.

Similarly, claiming that open plan offices put people under fluorescent light away from windows is specious at best. The typical 'old school' office set up had offices around the perimeter (ie windows) and kept everyone else shielded further from the windows.

I am more interested around what design works in open plan? Or, does open plan actually make you more sedentary because you don't have to walk to your colleagues.
I would say it's all three combined.
Wordpress is polluting the internet
Google Glass targeted as symbol by anti-tech crowd
Look, I'm arguing this because I'm a nerd and because I know you're wrong, not because I think this is a moral crusade or anything. But, once again:

Your "Cloudflare Challenge" (that's what you called it) was not a particularly useful way to answer the question posed by Heartbleed. What you want to know is, "is there private key material in heap memory?", or, to make things even simpler, "are our assumptions about how key material hits heap memory accurate?". The correct way to answer this question is to instrument and analyze an OpenSSL/nginx runtime, not to create and market a treasure hunt for an undisclosed private key on a single site.

You employ smart people. You could have done better than this challenge. Instead, what seems to have happened is that your company got inserted into the middle of a story it had little to do with (correct me if I'm mistaken and unaware of something your team did to research Heartbleed), and, with that spotlight shining, actively marketed a harmful false conclusion about the bug while also bidding for the spare cycles of other people who might have been more effective doing something other than poking at your server. (For what it's worth, I don't think for a moment that you did either of those things intentionally).

I think if you did either of those two things differently --- either didn't publicly go out on a limb suggesting that you thought keys would be hard (or, as Bruce Schneier seems to have read from your blog post, "next to impossible") to recover keys, or didn't set up the game site while doing it --- I wouldn't be moved to comment.

Like I said, not after pelts. Just, if we're putting the Cloudflare response up for questioning, I have some issues to point out.
I know what you mean, but this isn't quite the same as the Home Depot version. Do you really think he didn't bring any of the paid for thought about CI to the open source version?
I wasn't referring to the Java code. I stopped at the UML diagram. It was horrible enough by itself. Just look at it: https://en.wikipedia.org/wiki/Visitor_pattern#Diagram

For each class, you basically need to write an "accept" method to call the visitor. Fine for now. But then, the visitor specializes depending on the type of the object! Couldn't we just inline the appropriate visit method directly at the call site? It would get rid of all the boilerplate introduced by the visitor pattern, without duplicating more code. It would still suck[1], but it would suck less.

[1]: https://news.ycombinator.com/item?id=7589623
Copycat suicide is contested.

This has more detail:

http://thelastpsychiatrist.com/2006/10/werther_effect_copyca...

This podcast discusses the issue:

http://freakonomics.com/2011/08/31/new-freakonomics-radio-po...
> Most times, things need to be good enough, not technically perfect...

This sentence means almost literally nothing, given how varied both "good enough" and "technically perfect" definitions are for each developer.
Out of curiosity - why not TunnelBlick on Mac?
As soon as anyone knows, they are going to use that info however they see fit. Probably getting their own house in order before spreading the news, to not put themselves at risk.

However, even though spouting a conspiracy theory is a faux pas here, I can't help but wonder if the "he who smelt it, dealt it" rule applies here. Lets say your country were to setup a network interconnecting major research institutions, etc. After its use takes off and it is obvious that everyone is going to be communicating over this new medium in a short amount of time, you see the value in keeping tabs on people. You decide that it is in your best interest to put backdoors into encryption algorithms in enterprise communication software. So you see there are these guys that have become the place that everyone is starting to go to find what they are looking for. This is a good place to be. You eventually get your hands on this also. It's a waste of time and energy to constantly be decrypting everyone's messages, so what the hell- let's put a backdoor in that also. Everything is going well. Wait... ok, we should have thought of that. Another country now knows about this vulnerability and it hasn't been publicized, which means they will start using it to spy on contractors that work for us. We'd better leak this information so everyone fixes their hole. Let's tell Google. We're already on good terms with them.
Well, in answer to 1., often suicide is attempted at times of extreme emotional volatility - in other words, when it's easy to make a mistake. Additionally, suicide is almost always linked to depression, which manifests itself in a whole host of ways. It's easy to say "just point a gun at your head and shoot, what's so hard about that?" Well it's terrifying, which is emotional. It costs money to acquire a gun, and money problems are highly associated with depression. It's a social activity, and social anxiety often is related to suicidal behavior, etc.

If it were a decision like "which toothpaste works better", and you could calmly evaluate evidence and act impartially, I imagine there would be fewer suicide attempts, fewer suicides, and a higher percentage of attempts would succeed. But this is a vastly different sort of thing, an intrinsically uninstinctual act. This is just speculation, but I would guess that the rare cases where the suicidal person is overwhelmingly justified by his or her decision (Goering killing himself painlessly rather than being tried and hanged), the success rate improves.

In response to 2., I have no idea - that is an empirical question. But it's an interesting question, and it's good to see the topic discussed in the media as it generally is quite taboo.
Isn't he a multimillionaire just on paper?
Three major points.

1. Eich's action had no complexity or other goals. Eich supported something where the SINGULAR purpose was to strip a class of people of a right they had only recently acquired. There was no complexity to it, no shades, it wasn't as part of his duties, it wasn't as part of a team, it wasn't as something he was forced into, it wasn't something he regretted.
2. Mozilla isn't Dropbox
3. CEO isn't Board Member.
The engines do not burn for the majority of descent. You turn the engines forward and make a short burn. This reduces your velocity and causes the orbit of your ship to eventually enter the atmosphere.

Atmospheric drag is then going to provide most of your deceleration, slowing you down to terminal velocity. You then make another burn at the very end of the flight to slow down from terminal velocity and stop.

The second stage is a good example. After making a deceleration burn, it will be re-orienting so that the heat shield at the top is facing the direction of movement. It will then keep this orientation until it is safe to orient the vehicle around for landing.

You could use your engines for most of the deceleration... but it would consume a very large amount of fuel. No point in doing so when you already have atmospheric drag to do the work for you.
So, I'm Learning Meteor.js
He didn't treat anyone differently as a result of their orientation, is what I meant to say; and there were many statements to that effect from inside Mozilla (of course, since I don't work there and don't have the inside scoop, this is based on what was reported). Sorry, I wasn't clear about that.
Eclipse Lunar
Aaaaaaaand BOUGHT :D
No, it is the default of the law. They don't need an employment agreement. See the links in my replies in this thread. The laws says the own nothing...EXCEPT...anything related to their business.

They are being generous (or maybe just trying to make sure people don't quit) by signing agreements that let you out of the default law.
For the setup I will say it is on the same level of difficulty as it would be to setup iptables and routes manually. Yes, tinc does not abstract any of these things from you. But if you know what you are doing (not saying I always know what I am doing) it can be a powerful tool to build the exact network you want without any provider lock-in.

Now, I must agree on that, it might not be a friendly solution for dead easy routing to an exit node as a proxy with dns-tunneling built in. I just wanted to know why tinc does not get enough love, and you answered accordingly. But if you are building a serious network I do think tinc hits the sweet spot between being easy and allowing for any network you can think of without being tied to a particular server provider that might offer private IPs.

As for the configuration I use git, which makes it super easy to setup the N+1th server. None of the private keys are committed to the repo, of course. My infrastructure is not that big so I am still doing some things by hand, but it should be easy to automate some parts by using git hooks + puppet|ansible|chef.

About the protocol I do not understand why it would be a problem, other than not being ssh or the possibility of being filtered over the network. Doesn't most VPN solutions have their own protocol?
All known resources are finite.
It's weird that the author chose to use field accesses (in every possible instance) instead of local variables in the manually optimized version.