skysight-inc/HackerNews huggingface dataset:
> It sounds like lots of people (sockpuppet echo chamber) are saying if the new language/runtime doesn't fix all possible flaws we should stay with the broken-on-purpose OpenSSL codebase?

I think it's more likely they are saying that replacing one broken implementation with another broken implementation isn't worth the effort.

Sure, remote code execution and reading of arbitrary memory are a lot worse than an attacker figuring out a private key. But if an implementation of a crypto system is not able to conceal the private key, it is completely useless.

Seems to me like we may need to, first of all, redesign some algorithms to be easier to implement in constant time (like Ed25519 and symmetric encryption algorithms that avoid S-boxes), and secondly, develop a language that combines both memory safety and the ability to reason about whether an operation runs in constant time.

I'm not saying this is something we just do, it's a huge undertaking. I'm saying that it seems to me this may be needed, unless we want to find 5 years down the line, when everyone is using a Haskell TLS implementation, that attackers can retrieve the private key through timing attacks. That would be a fairly large effort put towards writing another TLS implementation that is broken by design.
From the perspective of a layperson with limited tech knowledge I really like the way you explain things!
Sure, and there are also StartSSL certs used on systems that don't use OpenSSL.

Do we just nuke every certificate, destroy their business, and force people with secure computers to buy new ones elsewhere even though their servers weren't affected by heartbleed? Because that option sucks too.
If you like tabletop, Myrmes looks cool http://boardgamegeek.com/boardgame/126792/myrmes
After the outrage generated by Brendan Eich's $1000 donation to prop 8, I would hope Dropbox associating with one of the people behind the Iraq war draws a similar response. If anyone's deserving of ostracization, it's war criminals who are effectively above the law.
http://web.archive.org/web/20140409162921/https://alum.mit.e...
It really frustrates me that there are separate clients that do the same thing, but talk to a different domain. If these companies cared about their customers they would be putting together an open source spec for cloud syncing so that we could just pick our favorite clients and tie them to the individual accounts.
This is really cool. Sure, similar tools have existed for a while, but Hound looks far simpler to setup and use than previous tools.

However, it would be nice to have this optionally run on every commit rather than only on pull requests. For my own personal projects, I obviously don't submit pull requests to myself, but I would like to have Hound double-check my code for me.
As soon as you increase number of shelter beds, you increase number of homeless in the city. For example see San Francisco. It's impossible to solve this problem locally.
I don't know that it's irresponsible, much less fantastically so. The legal angle is a good one and why upstarts can continue to outwit the incumbents (discount them at your peril).
Heartbleed: Separating FAQ From FUD
Your site still breaks when scrolling by dragging the scroll thumb down. On a long page, dragging the scroll thumb down (the way many people actually do scroll) makes the page jump around very fast, and skip larger sections as the page goes further down.
Out of curiosity, is it just the OP link, or is the entire alum.mit.edu domain blocked?
I missed the early Quora. By the time I stumbled onto it it resembled a "modern" Experts Exchange.
Is this the same as Munsell for Designers[0]?

[0]http://projects.kumpf.cc/projects/MunsellForDesigners/index....
> If it was me, I would just lie and say I have a degree. Keep applying until you find a company that doesn't check. If you are smart and talented, no one will think twice.

That doesn't seem like particularly good advice. Here's what I would have suggested instead:

> If it was me, I would just tell the truth and say I didn't have a degree. Keep applying until you find a company that doesn't mind. If you are smart and talented, the better employers won't think twice.
Plenty of shows taped in front of a live studio audience still sweeten it with a laugh track. But I have no idea if BBT does.

edit: wikipedia says yes. "Sweetening has been used in a number of television series, from older shows like Happy Days, Taxi, The Mary Tyler Moore Show, to newer sitcoms Two and a Half Men and The Big Bang Theory" http://en.wikipedia.org/wiki/Sweetening
Security vulnerabilities in C-CDA Display using HL7 CDA.xsl
That's a very good question. I think it's possible that the recent revelations will at least spur some interest in researching this. It seems like we need it badly.
I disagree. MyFitnessPal is in the top rankings in Alexa, and they get less than that. Add to to fact that tech is more skewed, I wager they get a bit less than a million a month.
Oh I agree completely. My point was exactly that they didn't solve this problem and that I think it's worth solving. Otherwise it doesn't "deserve" to be in the enterprise world IMHO.

Dropbox even have most of the necessary meta data and have the potential to solve it via their large app install base.
Ok, I understand why you proposed this. But what's hard to understand is why you are taking a discussion of rational alternatives to your proposal with such... angst? negativity? Not sure what you're feeling.

Consider the converse situation. You are proposing a rational alternative to continuing with OpenSSL as it is. That's a reasonable contribution to a discussion and it is not taken as an attack against OpenSSL.

This is just a philosopher's discussion on a place called Hacker News in the middle of a work day. :)
I think OverloadedStrings makes things more ambiguous. It's a power-feature, to be sure, but it also makes the use of Text and ByteString much more available in much the same way that numeric literals do (literally the same way, actually).

I think that sort of ambiguity is part of Haskell. It rescinds a bit on the HM promise of never having to write types, but Haskell has long rescinded on that in spirit and practice. It leads to a bit of beginner trouble, but, again, not any more than numeric literals do.

I welcome overloaded lists because I feel it'll make more libraries willing to expose Set-typed interfaces when that's the honest contract that should be upheld by the interface. That's what I want my types to tell me—not just what's syntactically convenient.
Take a look at Munsell for Designers[0] - it purports to solve the UI palette problem.

[0]http://projects.kumpf.cc/projects/MunsellForDesigners/index....
Same here, felt like scrolling through molasses.
re: operator precedence

Io uses Operator Shuffling to move those operator method calls back into normal mathematical expectation (or to be exact... C precedence order) prior to building the AST. Ruby's parser must do (or does) something similar. From lmm answer it sounds like Scala does something similar to Ruby here.

Smalltalk, Self & Rebol have no operator precedence and simply interpret the operators from left to right (using parenthesis to enforce higher precedence).

Some refs:

- http://iolanguage.org/scm/io/docs/IoGuide.html#Syntax-Operat...

- http://stackoverflow.com/a/2926639/12195

- http://www.rebol.com/docs/core23/rebolcore-11.html
Who am I going to trust less? StartSSL certs? Or OpenSSL?

I'm not saying I don't appreciate the hard work the two OpenSSL developers put into the code. But its incredulous that we're upset a business would give away a service due to an event completely out of its control.
Interesting. However, your sources are rather obscure, and I'm not sure what you mean by "a weak form."

I'd say a Baysian analysis is a way to evaluate the veracity of an argument from ignorance, not necessarily a replacement of that argument. An argument from ignorance is a strict subset of a baysian analysis in which there is no causal relationship between the missing evidence, and the conclusion. This is such a case. So we can conclude by using a baysian analysis that this is in fact an argument of ignorance.

Unless, of course, you have additional statistical samples that show a non zero relationship between not knowing about NSAs activity and the fact that they are engaged in that activity.
The flip-and-the-flop have in common being <both> opportunistic and self serving.
Use `list()` to force eager evaluation with Python 3 map / filter.
Mine is shorter i believe?
https://gist.github.com/Foxboron/6643154
This is utterly ridiculous. These people signed up for a free SSL certificate knowing that revocations would cost them money. Enforcing a contract that both parties willingly agreed to does not make them untrustworthy, it demonstrates that their customers carry immense senses of entitlement.

There are tons of SSL certificate providers out there. Their business model was not a secret when folks signed up.
It's great to see people working hard on projects, but HN doesn't have enough space to tolerate most reposts for feature upgrades.

In this case, there was a major thread just 80 days ago, so marking the current post a dupe isn't really a hard call. Sorry to disappoint.
An interestingly large number of words and phrases originate from nautical vocabulary. That vocabulary in itself is so vast, it sometimes feels like a different language.

Here's a partial list of nautical words in common use today: http://www.dailywritingtips.com/50-nautical-terms-in-general...
More evidence piles up suggesting a Google apps redesign is coming
What are good alternatives to StartSSL? Either free or moderately priced
Loved Amiga, Atari and Pong? Huge Old-School Collection Seeks New Home
Any good/bad experience using prebuilt VM images that contractors can just download and start working in ? (Struggling with kind of the same issue)

I also tried Amazon Workspaces the day it was released but it looks like the RDP connection from locations with low bandwidth internet connections (where most of my contractors are ) is not good enough to do actual development/coding work
You are greatly misrepresenting the comment you're replying to. It is not suggesting that Rust is better because it's newer. It's suggesting that Rust would avoid this vulnerability because Rust is designed to avoid this vulnerability. It is absolutely possible to "magically solve problems like this" at a language level. Buffer overruns are possible because of specific decisions in the design of C. They simply do not exist in, for example, Java programs. There will still be errors that can occur, but this particular bug is 100% an artifact of C.
I'm upto 18.9gb permanently free on my Dropbox account. They periodically do promotions that give you permanent space. After using Dropbox for 5-6 years I'm still only using 62% of that space. For just storing documents, code and the odd file I'm sharing with people I've had no issue with the space available.

Last year there was the 'great space race' where they were promoting to students, I think I got 8gb for that. (https://www.dropbox.com/help/390/en)

Before that there was a beta for testing out their new photo system. Which gave a max of 5gb free. (It appears this is still available to give you upto 3gb https://www.dropbox.com/help/287/en)
One of the most important features to the company I work for is being able to share sub-folders within a shared folder. Without it, you have to completely give up hierarchical organization of your data.

This feature is still missing as far as I can tell.
Maximizing contrast improves readability. Can't you just turn down your screen brightness if it's too bright?
Ideally I'd prefer (rather than infinite scroll) progressive gzip and just flush/chunk out more data all at once. Technically not infinite but fast, simple and overall a better experience, in my opinion.
So how the hell do I upload 250GB of photos to them without dying of old age?
If I remember correctly, http://gandi.net/ offers 1 year free SSL cert if you buy a domain. To be honest the difference between an excellent cert and good-enough cert is what you want to protect. If you think your data is so sensitive and you accept that we must rely on CA at the moment, you wouldn't be using StartCom free cert.
https://github.com/bbatsov/rubocop FTW. Integrate it into your test suite and you can see your mistakes before you push up a change for your team to see.
So you're dutch... that explains your arrogant anti-american sentiment. The only point i am trying to make is you should try to understand a person's culture before understanding their actions.

For what it's worth, i'm from Canada.
Let me see if I have this straight:

Alice's Lemonade Stand charges $0.25 for a cup of ice-cold lemonade,
and has a recycling bin that her customers can use for free.

meanwhile, down the street:

Bob's Lemonade Stand gives out free lemonade,
and charges $0.25 to use their recycling bin.

The message here is basically "boycott Bob for his anti-recycling business practices", right?

Seems like a distinction without a difference to me.
Finally, I've been taken seriously on this board.
Way to be disingenuous. The argument has nothing to do with their technical skill in rolling out a fix, but their lack of communication.

"No action required from customers. - Eveything seems to in in order now."

What? What about their customers revoking and replacing certs?
A bug in a PGP implementation could have leaked your PGP private key. A bug in an SSH implementation could have leaked your SSH private key. CAs may be a flawed concept, but I don't think they have anything to do with Heartbleed.
[HIRING] (Montreal or Gatineau) Senior Software Developer – SDN/NFV
Here's mine:

['Fizz' * (not bool(i % 3)) + 'Buzz' * (not bool(i % 5)) for i in xrange(1,101) if i % 3 == 0 or i % 5==0]

EDIT: I hate lambdas. Also I'm not saying the above is pretty or a good idea, but I had some fun.
+1 for the pythonic version
-1 for the weird rest

this assures me that python is the right language for me :)
I don't think you need to even explicity say he's used to Java.

Wow... I've never felt the need to the use the factory technique.
A highly Pythonic, Easier to Ask Forgiveness than Permission[1] version:

FIZZ=3
BUZZ=5
cache = {}

for i in range(FIZZ-1, FIZZ*BUZZ, FIZZ):
cache[i] = 'Fizz'

for i in range(BUZZ-1, FIZZ*BUZZ, BUZZ):
try:
cache[i] += 'Buzz'
except KeyError:
cache[i] = 'Buzz'

for i in range(100):
try:
print cache[i%(FIZZ*BUZZ)]
except KeyError:
print i+1

[1] https://docs.python.org/2/glossary.html#term-eafp

A generator version:

from itertools import izip, islice

def fizzes():
i=0
while True:
yield '' if i%3 else 'Fizz'
i += 1

def buzzes():
i=0
while True:
yield '' if i%5 else 'Buzz'
i += 1

def numbers():
i=0
while True:
yield str(i+1) if i%3 and i%5 else ''
i += 1

print "\n".join("".join(parts) for parts in islice(izip(fizzes(), buzzes(), numbers()), 100))
Many phones also have magnetic compasses, so you can get an accurate bearing without needing GPS signals. I would expect significant advances in inertial navigation systems in mobile devices in the coming years.

https://en.wikipedia.org/wiki/Inertial_navigation_system
Okay, I'll try and supply some better titles and hopefully make the mods' lives a little easier.
Are there any cert providers who have particularly solid reputations?

I get basic certs via my domain provider Gandi, they run ~$17 year (12 euros), or $160 for wildcard which seems steep.
There's still an expectation that a skilled navigator can work out position and movement by hand, using charts, speed and compass headings ("dead reckoning") and have those results reasonably match/confirm the information reported by more modern systems. Using knots makes this significantly easier than it would be if speed and distance were reported using statute miles or another unit that's not easily converted into change in Lat/Long.
Yes, yes I did knowingly break the law in doing that test.

I rely on the good grace of my employers and my banks not to press charges for this. Of course I commit many other felonies regularly also.[1]

Yes, I think it should be legal to do this sort of vulnerability test, but I doubt that the legislature (or even myself, if I were made dictator) has the ability to write a law that criminalizes "bad" exploit abuse while allowing "good" exploit abuse.

[1] - http://www.threefeloniesaday.com/Youtoo/tabid/86/Default.asp...
Interrupt Services DOS/BIOS/EMS/Mouse
Good on them. Competition between Digital Ocean and Linode for the customers that often sporadically use machines will just be great.

Though, FWIW, still sticking with DO for the 5$/mo.
[print(("Fizz" * (n % 3 == 0) + "Buzz" * (n % 5 == 0) + str(n) * (0<(n % 3 * n % 5)))) for n in list(range(1,101))]

side effects don't matter right?
Mobile phone charges in 30 seconds using new technology
Nice job. I really like the ease of swiping to up vote, down vote, and save.
That's true, but I think 2 solo-projects can sometimes combine to be achieve more than they could separately.
Show HN: Unity Web alpha demo of our action/puzzler game Phil the Pill
I haven't used Discourse, but in general I'm not sure pages are meaningful in forum software. The unit in a forum is the post, not the page. I read from post 1 to post N and the page boundary is always arbitrary. If forum software dropped the pagination but added post-ination, I'd take that as a very beneficial swap.
"What do you think?" is just wasting my time/effort to answer you, since you'll either tell me its ill-considered or say something nice but not use/act on what i say anyway. just tell me what you want done, i'll do it, don't provoke me with that "What do you think?" nonsense.
NaCl is designed to be user-proof. Part of its appeal is that it uses state-of-the-art primitives and constructions, but the reason it's so widely recommended, and the thesis behind its design, is that it's hard to misuse.

The same isn't true of LibTomCrypt.

Use NaCl. Be very, very careful with LibTomCrypt.
Shorter and more pythonic, but not one per line:

' '.join(["FizzBuzz" if n%15==0 else "Fizz" if n%3==0 else "Buzz" if n%5==0 else str(n) for n in range(1,101)])
Each bird has redundant cesium clocks. It would be interesting to know if they also include redundant NUDET sensors.
> a 3rd open source product that's as mature.

NSS, which is used by Mozilla and Chrome. For Apache, just google mod_nss or read this: https://stomp.colorado.edu/blog/blog/2010/06/04/on-setting-u...

It looks like NSS isn't supported on nginx. Hope somebody puts that on their todo list!
So what about the '*' in C or even better the '.' in so many object oriented language.

> The bottleneck when writing code is almost never keypresses.

No, it's readability and that often comes with terseness. Every line break because I have to spell out lambda or every refactoring that removes the function from its original context so I can avoid a line break is bad for readability. In that aspect the '\' in Haskell does great. Also in Haskell anonymous functions are so important that they definitely deserve their own special character to shorten many expressions.

I only see this becoming a problem if it is used in excess, like in C++ and especially in C++11.
Uber Is Giving Startups 7 Minutes To Pitch Google Ventures Investors
Brain bleach, really? I think the spider is quite beautiful.

I must be a psychopath :-)
Keeping quiet to protect this person who discriminates based on race is where you draw the line with your moral compass... You find no irony in this?
Thanks for your detailed reply.

I still fail to see how this is fundamentally different from a similar approach in C (but maybe that's because I don't understand Haskell at all). In C you would define your ConstantTimeInt as a struct, and define a bunch of functions that operate on this struct. Using a + or * operator is also not defined for this struct. You'd have to use

csiAdd(const struct ConstantTimeInt *addend1, const struct ConstantTimeInt *addend2, struct ConstantTimeInt *res)

In all cases it requires the developer of the library to be conscious of timing attacks, and not just use a regular int with variable-time addition.
reminds me of pressy http://get.pressybutton.com/
Not sure it should be obvious you don't. Pull requests are especially well-suited for a team environment, but using PRs in a solo project can still give a higher level of structure to the progression of your code. Gives you an opportunity to explain why you're doing what you're doing.
$7,043 x 2 x 2 x 50 = $1,408,600

But anyway I don't think any of the numbers are unreasonable. These are ballpark estimates, and I'm pretty sure my tympanoplasty was a relatively boring procedure for him, compared to stuff like cochlear implants and other basal skull surgery that he does sometimes. My main point was that I don't think it's unexpected at all for some surgeons to bill several millions to Medicare in a year. They can easily clear several millions already with a very light schedule and, depending on the specialty, some or most of that may be from Medicare patients. Honestly I think there is no story here.
The Cost Of Permission Culture: Or Why Netflix Streaming Library Sucks
When you're writing Haskell in emacs (like you should be), you enable haskell-font-lock-symbols in haskell-mode, and it displays the lambda as it should be (plus a bunch of other symbol corrections for ::, ->, =>, (), ||, &&, etc.)

Full list here: https://github.com/haskell/haskell-mode/blob/master/haskell-...
It is totally valid for you to be a jerk, and then it is totally valid for other people to call you out on being a jerk.

Yes, maintaining a revocation list costs them time and money. But this is a Big Deal. Extenuating circumstances. They have a social responsibility here, and they're failing at it.
You're assuming that the JVM is secure. But yes, good point.

Although I'd argue that a truly strong type system should also catch problems with pointers. The compiler should try to prove that any pointer access/arithmetic can or cannot cause undefined behavior - if it could cause undefined behavior, emit a compiler error, if it cannot prove that it won't cause undefined behavior, emit a warning and insert a runtime check.

(Still have the underlying "unsafe" functions. But group them into part of the standard library as an "unsafe" package.)
When you write too much Haskell, your Python code starts to look like this:

print('\n'.join(
'FizzBuzz' if x%5==0 and x%3==0
else 'Fizz' if x%3==0
else 'Buzz' if x%5==0
else str(x)
for x in range(1, 101)))

I would really like to have a "let" expression in Python to avoid having to write a new function with a def statement when you could get away with a simple lambda or generator expression.
I'm confused. So many comments here but the link returns "Not Found. The requested URL /2014/04/mike-judge-silicon-valley/ was not found on this server."
No, the free version of Google Apps was not a paid offering. The paid version is, and is still going strong.
Slow and steady.

At 2Mbps upload it's only about 12 days.
But it pops[0]! In 10 years I hope we look back at these ridiculous scrolling beasts and laugh at them the same way we scoff at the flash intros from not too long ago.

[0] http://theoatmeal.com/comics/design_hell
I think it was better icbm guidance since inertial guidance tends to drift quite a bit on long flights.