skysight-inc/HackerNews huggingface dataset:
No, this was not a good response. It was well written and took responsibility for bad code, but it failed to address the elephant in the room: why were keys not immediately rotated?

I've said this a number of times lately, but it bears repeating that the golden rule of security is: If a compromise occurs, assume that everything is compromised. Even if their approach was tested to be perfect, they shouldn't have made the assumption that that actually reflected reality.

They were extraordinarily irresponsible. There's simply no other way to slice it.
I don't recommend converting issues to Pull Requests. See the discussion here which goes into details: https://github.com/github/hub/commit/4f70dd126f46dec14fc341c...
This is an interesting idea. I am consulting in data analytics and I get two type of clients. One where client hasn't made decision and looking for data analysis to guide them. Second where client has already made up mind and looking for data to convince others of their decision. How to lie with statistics can easily fulfill need of second type of client.
They also said

> In parallel, we are evaluating the other claims made by the researcher, to understand what actions we can take to improve our customer protection.

which seems to imply that they're at least looking into the other questions.
It'll be interesting when someone sues for a false positive result. Emotional damages can be costly depending on your state.
You can often trigger a rebuild for such services via their web UI.
Of course, the entire premise of this operating system is that VMs are secure, even though there have been exploits targeting them in the past [0].

Disabling virtualization capabilities in the bios is a semi-common recommendation for securing a computer... Still, this OS is a darn sight better than nothing and it'll certainly protect against most things. However, touting it as perfect is misleading.

[0]: https://en.wikipedia.org/wiki/Blue_Pill_%28software%29
He/she is complaining about the webpage being too wide.
That's only true for factual statements. It's perfectly possible to reach different conclusion starting from different moral premises.
Hey mate,

Awesome idea and they look great. My only caveat would be the logo might put off corporate customers (who may be your biggest customers.)
Fantastic suggestion! I always disliked opening a PR after my first code change. Will definitely start using this :)
We've been waiting for a long long time now.

http://www.cs.nott.ac.uk/~cah/G51ISS/Documents/NoSilverBulle...

abstract reasoning doesn't become any easier because it's done via the form of pictures.

If any of this stuff was actually remotely possible, we'd all be building our software from UML diagrams right now.
Here's one on Ebay for $10k.. Ebay!
http://www.ebay.com/bhp/300-hp-electric-motor

General Purpose 350HP motor. $25K
http://www.globalindustrial.com/p/motors/ac-motors-2-phase/3...

In general these motors have tight tolerances and aren't the motors in your electric shaver

The entire car cost $70K...
Why people are only talking about SSL keys? Because Heartbleed allowed to fetch any data, that could have also included SSH keys and or any other authentication credentials / information the server got, for itself or to other services. As example if your site got Facebook API keys it's possible that those have been leaking too.
(2) & (3) are not bugs for OpenSSL because only Akamai is trying to segregate the key data.

In upstream OpenSSL the intermediates are stored in the same memory pool as the key data. Thus the intermediates do not expose privileged data anywhere it is not already present.

Without addressing issues 2 & 3 Akamai's patch is not a line of defense. It does not guard against dirty memory exploits like Heartbleed, it only increases the difficulty of exploitation.
... Been around as a joke. Like read this one:

https://www.grc.com/ssl/ev.htm

You'd think it's an odd mix of satire and CA salesmanship with a healthy dose of not understanding how anything works, but apparently he's serious.
It's not hard to imagine rote programming becoming a universal skill among high school graduates. I could even see this happening within our life-times; it's really only a matter of societal will and available teaching staff. The basics are... basic.

If this happens, then APIs and libraries that make development easy and intuitive for end-users could easily become as in-demand as well-designed websites and mobile apps are today.
> (I'm not even sure you can load your openssh server key into ssh-agent, can you?)

Yes, actually, as of OpenSSH 6.3 you can. (I wrote most of the patch that added that feature.) However, even without doing that the OpenSSH server performs crypto operations in a separate process from the network-facing child process (unless you've disabled UsePrivilegeSeparation). The purpose of having the server talk to an ssh-agent was to allow keeping your host keys encrypted on-disk or loading them from a smart card.
We are, in fact, evaluating those other claims, and testing them in our labs. We are also evaluating claims made by other researchers, both publicly and privately; and we hope to end up with both a better library out of this, as well as a better understanding of the hazards we do and don't provide safeties against.

Validating his first claim was sufficient to undermine our belief in key safety; the others are therefore only relevant for protection against future attacks. In that light, it was important to advise our customers and the community at large.
Ukraine is broke to a large extent because it's economy has been essentially taken over by corrupt oligarchs with close Kremlin ties. As far as comparisons with U.S., in the context of the cold war U.S. has done some nasty things. But look at all the countries which U.S. was heavily involed in. Taiwan? South Korea? Chile? Germany ? Japan? How are they doing 20, 30 years later. Now look at countries that have had heavy Russian / Soviet involvement. Cuba? North Korea? Sorry, but the comparison doesn't quite compute.
If only there were some sort of transparent onion router that could obscure the geographical source of your network traffic!
Even eight hours a week -- a fifth of the work week -- doesn't sound like it'd be enough time to get to all of the complaints and issues.

15 minutes per issue for eight hours (no accounting for breaks or time between) would be 32 issues. Per week. Even 40 hours a week is 160 groups, which seems pretty small given the size of the US.

Lobbying and staffers exist because the time of our representatives is really limited. I think it's a really awful solution, but I'm not surprised that it exists.
If they can break out of Chrome sandboxes they can target Qubes
The Ability To Focus And Make The Best Move When There Are No Good Moves
You're not the first to suspect that Maud and Pinkie Pie were intended to represent Aspergers and Williams syndrome.
When a company says "we're not changing our potentially compromised keys because we're protected by this magic box" and you punch a million holes in the magic box, your goal should be to make it well known that the protection is faulty. He accomplished that quickly, and now they're finally doing the right thing.
Automated bug detection using analytics
You can't run with the machines
I'm a caffeine user, have been for years. But the most important thing I've done for my cognitive fitness is to be aware of and adapt to my changing reaction to food.

As a teen, I could - and did - consume frightening quantities of sugar with few ill effects, at least intellectually (very high metabolism, about 145 lbs all through high school, A+ student, great scholarships). University wasn't too much different, though adding beer added weight.

Now in my late forties, I can feel the difference between sharp days and dull days. Too little sleep is the biggest contributor, too much sugar - or, more to the point, a protein-fat-carb imbalance - the other.

I know how much coffee I need, and I know how much is too much. I can feel the glucose hit and insulin rush if I have the wrong sweets at the wrong time.

Sometimes I can feel my sharpness, my intellect, being just out of reach. I hate days like that, when I feel stupider.

I also know that if I can skip one day of exercise after 2 or 3 days on, but not skip two. Without the squats and weights and deadlifts, I can feel myself slipping all the more.

Would I take enhancing drugs? At 48? Knowing that I am on the slow decline, that I need to slowly but continuously up my dietary awareness and slowly but continuously ease off foods I've always liked?

Yeah, maybe. What are the risks? And am I am objective enough to evaluate them?

Dunno.
You mean Amazon Mechanical Jerk
shocking. he was just 5 days into being executed by the state. makes me think if execution really does anything, especially when there have been several cases where justice was inappropriately carried out on innocent people.
uh if it's GPL, don't you have to release it?
https://news.ycombinator.com/item?id=7578365 talks about this.

Keep in mind that because of the constant job-hopping society seems to be forcing on most developers (either stand still in your career, or job-hop), you should treat this as a single isolated game of prisoner's dilemma with participants that will never play again. In other words, there's only one winning strategy : always betray the company. In this case that would mean say whatever needs to be said to get you hired/an offer. Also this works reasonably well in normal situations as well, if you're negotiating about anything, make it clear that your default first play in the prisoner's dilemma is to betray, but it's up for negotiation. If you don't do this, any sales/management drone worth his salt will immediately exploit this.

If you don't know yourself, and have attempted and failed to look this up, why do you assume the other person knows, really ? Either the other person is competent or not (ask a really difficult but slightly wrong question to find out, in a roundabout way, like "I can't get my head wrapped around how 'static' affects global versus local variables. It makes global variables no longer stack allocated, but what does it do to local variables ?". It's a nice obvious error that shouldn't make a capable person think worse of you, because it gives the perfect explanation, just assigns it to the opposite concept it should be assigned to).

If they don't catch the error, assume they don't know anything, because they're a manager or HR drone checking boxes. The only thing to do is get past them. For the love of God, don't tell them they missed the error. Frankly, you'll be doing both yourself and your future team a favor by inaccurately checking their boxes. Also, getting past them is a good exercise in corporate skills, if you get hired, it won't be the last time you need to get past them. If you feel like honesty is a value, I would advise you to save your perfect honesty for obviously technical people, not for management. Don't outright lie, but absolutely try to avoid saying "no" because of technicalities. "Do you have experience with windows vista ?" -> "I have experience with windows".

Keep in mind that the interviewer may be trying to do the same, stating an obviously wrong fact and asking you to check that box. "Do you know java 9 ?" is way too obvious, but something along the lines might be asked. Best answer to this is to inquire, not directly state it doesn't exist. E.g. "I'm following the java 8 updates, and there are some proposals that have been decided to be beyond java 8, but to my knowledge there is no java 9 software existing outside of Oracle. Can you clarify ?"
Apparently, nobody on teams has time to invest in recruiting. Because meetings. Or something.

Here's the reality: these companies can't hire. I know it and they know it.

They can't hire because they're invested in cancerous HR bureaucracy. Think The Crimson Permanent Assurance, the opening scene in Monty Python's "The Meaning of Life." Turns out there's a reason why The Very Big Corporation of America can't move fast and hire the people they need. And a lot of smaller companies trying in vain to hire like this don't have any excuse to act like VBCA because they aren't big now and never will be.

They can't hire because they won't pay market salaries, don't offer enough equity, and try to make up for it with a combination of pizza, Red Bull, foosball, and nerf guns.

They can't hire because their office is a place that makes Initech (the company in Office Space) look appealing.

They can't hire because they skimp on benefits.

All this has been covered before, but VBCA refuses to learn anything new because they don't want to change the way they do things.

http://www.joelonsoftware.com/articles/fog0000000050.html
No offense but "why"? And it's not elegant either (missed word I thought)
3. Microsoft Outlook. If you've worked at any of these big organisations, you quickly learn Outlook plays a big part in day to day running of the office.
I made something like #1 a few years ago, but it never took off and I eventually grew bored of it. It's on Google App Engine and open source if anyone is interested to continue with it.

http://wikiblog.jugglethis.net
> General purpose tools for non-programmers: Since then, there hasn’t been much work in these areas, but from what I’ve seen that might change soon.

Really? Loads of examples. One just off the top of my head is Scratch: http://scratch.mit.edu/
Big carriers remove Samsung’s ‘Download Booster’ from the Galaxy S5
Decisions were made about certificate revocation based on assumptions about this code and Akamai customers ended up being exposed.

Perhaps third-party security validation of such a critical piece of code should be a prerequisite before asserting that no further countermeasures such as key rotation were necessary. Such an action would demonstrate significant diligence as compared to a public release days after you've told customers there was nothing to worry about.

Additionally, that public release didn't directly encourage security review, the deprecating comments on the post were primarily around portability and design.
Firefox that I'm running seems to block the website.
With Comixology, Amazon Acquires a Piece of the Comic-Based Media Empire
> Developers have steadily marched upwards from Assembly to C to Java to, today, scripting languages like Ruby and Python.

Since when does being a dynamic language and not having to have a main() function make you a "scripting language?" I didn't know people still said those words.
Link to reddit discussion:

http://www.reddit.com/r/science/comments/22yed5/living_with_...
Ok, Thank you for the clarification. The irony is I probably should have been a bit more elaborate in the context of my question. I'm fairly new on Hacker News and I probably should read more comments pertaining to other posts to get a better perspective of the etiquette on here. But again, thanks for the clarification and I will commit to bringing proper thought to my comments
for #2 I walways think about building a personal note-taking service for ideas, further developments of ideas and ideas that generate other ideas, in a tree-based structure.

It would work as a personal thing, but it would also do some similarity search and show ideas from other people that are similar to each of your ideas "near" them.

So, if you found the others' ideas useful, you could link the two and proceed from there. The other part would see their idea got linked by you and will come and check your idea, maybe establish contact, maybe not, maybe just ignore the linking and proceed working alone.
Unless your web server makes SSH connections from some kind of in-process application, why would this bug allow SSH keys to leak?
Hacker successfully uses Heartbleed to retrieve private security keys
This manner of cost estimation is not convincing to me, for reasons that should be obvious to anyone. There are plenty of small things that cost a lot of money, because, perhaps, of the precision or techniques required to manufacture them or their components, or the dearness of the materials that compose the minority of the object.

TL;DR: What is a sub-one ounce object made mostly of silicon that costs more than a thousand dollars. http://www.newegg.com/Product/Product.aspx?Item=N82E16819116...
These things get used all the time --- especially when statistical, economic or engineering analysis is being performed. Also, most users aren't using these features directly, they're using a template created by someone who did know how to use them. Most of what the end user does is punch in this years data and interpret the output.

For a specific example: unless LibreOffice or Google Sheets develops a solid equivalent to the Solver add-in, replacing Excel will be a non-starter in any department that deals with Engineering data.
What is more interesting is to look into experiences of the Soviet military in modern warfare in Angola for example.
Good news. They have another 5-6 years to recognize their mistake and cut Python 3 loose from Python, like Perl did with Perl 6. It's interesting how the same underlying mistake manifests itself in different cultures: Perl 6 was "we'll break all your code, but give you gonzo new features that we hope are useful." Python 3 was "we'll break all your code, but soothe some pedants and browbeat you into accepting the result."
Just about everything he writes is MASM. He talked once briefly about a custom packet rewriter that sits on his edge to assure that any packet reaching GRC or his internal network is properly formed. He didn't divulge much else about it.

He did take up Javascript a couple years ago because of a new-found value in client-side processing and canvas[1] for animation.

He's currently working on SpinRite 6.1 with modern I/O support and an authentication mechanism he came up with out of the blue called SQRL[2].

[1] https://www.grc.com/animation.htm
[2] https://www.grc.com/sqrl/sqrl.htm
It doesn't provide the "Suggest Edits" feature for blog posts, only answers to questions. Until I discovered Quora, I was working on http://wikiblog.jugglethis.net/ which was my solution to this problem.
Programming for non-programmers is an oxymoron to begin with. Even using Excel is programming.

I've become convinced that one of the reasons this field has failed so spectacularly in the past is because people are trying to achieve something that is literally impossible.

In order to communicate with computers you have to become computer literate. Or at least, it's far easier (and will remain so for a while yet) for a flexible human to become computer literate than for an inflexible machine to become human literate.

Finding better ways to make humans computer literate is and will for a long time be a much better path to make computers more accessible, and it's largely what's worked to get us to the point we're at now.
This also means that design is playing a proportionally larger role in startups.

A lot of the engineering work needed to build the next Instagram/WhatsApp/etc has become commoditized. Design is what's left.
I like it. It is like Mixpanel, the implementation on the page would be similar, but without data aggregation.

There are open-source Mixpanel-like backends out there, some will not come with a frontend full of charts, you should just get one of these and build a frontend full of feeds.
Am I right to think this would not increase throughput for a single stream (eg Netflix), but only when downloading from multiple sources (eg BitTorrent)?
The 3 people who work on Qubes [0] are very good security researchers and I have more faith in their work than most.

It should be noted that the OS's VM'ing is based on the Xen bar-metal VM kernel which is pretty well researched, small, and elegant.

[0] http://invisiblethingslab.com/itl/About.html
And they say that hardware startups are hard. Hardware startups that require hundreds of custom, million dollar station installs, AND cooperation from a significant fraction of car manufacturers... are the hardest.

The Tesla Superchargers cost about $20k each to install, which is low enough that they didn't need anyone else's cooperation to cover the US.
Or recruit a few people to help.
A mobile app that scans for unsecured WiFi and automatically sends the location to the service. People who want free WiFi can search and find the closest one.

It's sure to cause some legal/moral controversy, but it is pretty trivial to implement and might be pretty interesting.
I don't see how that follows or relates; chrome's sandboxes are definitely not VMs... VMs are in general better understood and far better isolated.

Can you expound on that comment?
Since the government has paid for the additional patches to be created, can Microsoft please send them out to everyone running XP that can't afford to buy a new computer?
Are Speculative Bubbles Good (for innovation)?
There was an article this week about how Intuit among others lobby to keep the tax code difficult.
You can already enter a drop-off location. It might be that Uber needs to make this feature more pronounced in the UI.

On the confirmation screen, you can tap a little plus button next to the pickup address to enter your drop-off location. It's come in handy for me a few times.
Nope. As long as they don't distribute it but only run it in a server, they don't have to. This is what the AGPL is changing.
The turd in crony capitalism is government.
>>It's interesting that when it involves a founder we're suddenly no longer considering the obvious scenario that the author is one of the many coders who is simply not good enough and has to go.

Sure, Pay up the fair compensation. Then he can have a clean exit.
I would really not assume competence on the part of the other people in this arrangement. Once this guy goes, the CEO is locked into an expensive team, and will need to find equity and cash to motivate them. They can dilute this guy's share to start, but why stop there? And how well are future funding rounds going to go when the investors realize this?

No sane startup would ever get rid of a technical cofounder who knows the stack and can be motivated by his ownership stake to keep the servers running in a worst case scenario. So it really sounds like the CEO is incompetent and doesn't realize he needs to preserve his ability to remain independent in order to have leverage with investors.
Contrary to your statement about how it could be __surprisingly accurate__, it would in fact be the opposite. There is no accurate way to build a calculator to show different liquidity outcomes because there are way too many unknown variables if you understand how stocks actually work in a given company. Everything would have to be a complete guess in the dark for the employee punching in those numbers making it near impossible to get anything accurate, particularly early stage.
I am working on that. :)
UberRUSH Raises Three Critical Questions For Mobile On-Demand Services
>That said, if dependent typing takes off, no doubt we'll see languages that fuse it with C-style syntax soon after, just as we saw with OOP and basically every other thing since.

Indeed, type systems for (actual) Javascript are often formulated in terms of dependent types.
Google could implement this very effectively when they have a couple self-driving cars going around each city scanning for empty parking spots.

Before then, you might have to do something hacky like user-submitted data.
Can anyone point me in the right direction of an article that sums up how this whole fragmentation started? I'm curious to know the history.
Most of the gifts right now are pretty generic and we have software that automates it. Later we'll have to figure out how to scale this.
This. Thanks for putting words to a thought I've had for a while. It's already happening. We're transitioning from web/mobile app demand to services demand, which explains the relatively recent explosion of the SaaS/PaaS/IaaS models.

Also, there's no reason to base it on an arbitrary threshold like high school graduation. The amount of rote programming I have to do (as a professional working in the field of 10 years) is drastically decreasing.