skysight-inc/HackerNews huggingface dataset:
Countless companies have successfully rewritten their products. Properly done, people outside the company never even realize that it was done. Joel has a sort of reverse survivor bias; those who fail are noticed, but those who succeed are ignored.
Pretty sure the laws / etc in place right now make sure no individuals can be held responsible for that kinda thing; do (former) presidents get charged with mass murder for wars in Iraq / Afghanistan, for example? Government is different from common sense of law and right and wrong.
That's terribly negative. If you are doing agency work maybe (same website, same functionality, just different skin) but that vast vast open plains of http-based development are around and going to be around joining parts of the business, public world together in ways they do not know or imagine.

Yes, binary trees are pretty much coded for you, and you would be a fool to roll your own hashing algorithm for production, but thats still not a reason to keep your head down.

The next decade is going to be fun. Trust me
Mobile War Metrics
TL;DR: We've already got your data from other sources so we didn't need to get it via Heartbleed.
I live in a major US city. The biggest deterrent I have is living in a fenced in apartment building accessible via a narrow, steep hillside stairway. Burglars just never bother.
This is really nice, thanks for sharing it with us.
Or they straight out lied.

Wouldn't be the first time.
Seriously... this is like appointing Pat Robertson to the head of the California Porn Producers Association.

It is just about that stupid. Maybe stupider. Or else there is a whole lot I really don't understand and the managers of Dropbox do.
With NULL terminated strings it also was simpler to serialize it. If str+len was a standard now we would have 13 more serialization standards.
Everything Under One Roof
HMO: Need help with Marketing for app that will be launching within two weeks.

Project: http://NewsCast.io

Project: News App that summarizes articles across the web.
Status: The app is done. Website done. I really need help with putting it out there so people are aware of it and build a presence. I know we can grow this.

I can help with new ventures or partnership.
Agreed. One of the best links I've ever followed from HN.
So do regular people driving. I don't see why these regulations should only apply to taxis and not all traffic. Why is it ok to own a car and drive in exactly the same places, and use up limited parking spaces? But as soon as you pay someone to do it it's bad?
The length of each node is not the same; each character within a node is the same number of bytes long.

So you end up with one node in the rope that has one logical character - that is some absurd number of bytes long. (In reality there'd be a maximum of 2^8-1 or 2^16-1 or something bytes per character)
it's time for the community (and possible all major opensource projects) to have code review parties.

1 week before, a module is declared the subject. at the time of the party, the major owners are on the hook for function by function questions, and line by line when it merits.

reddit? or even a special github community service.
"If the Federal government, including the intelligence community, had discovered this vulnerability prior to last week, it would have been disclosed to the community responsible for OpenSSL."

I see numerous disclosures from technology companies, security researchers in industry and academia... but for the life of me, I can't recount an instance in which a disclosure came from intelligence-community researchers. Is there any historical evidence of disclosures from the NSA to the open-source community?
I agree on this point. This seems more like being a white knight than anything. I have nothing against female programmers, in fact, I actually wish more would come into the profession. But this is a bit much.

There will always be assholes everywhere you go. Labeling all male programmers as misogynists is kinda insulting.
USDA Bans Junk Food From Schools
Show HN: What do you think of Shopaholic (sale items on your new tab page)?
Hey guys,

I just launched a demo yesterday for Shopaholic, a project I've been working on recently, and now I'm looking to validate the concept.

Check it out here: http://www.getshopaholic.com

It's a Chrome extension that asks you to follow your favourite clothes stores then turns your new tab page into a feed of sale items from those stores. Very simple idea but it's had a warm reception in its first 24 hours with a couple of hundred signups.

I'd be very keen to hear your feedback.

Thanks very much!
it would also imply that a collision with someone where both of you are going 32.5 miles per hour and hit each other head on would end in near 100% fatality.

That said, I would believe that a head-on collision at around those speeds has a high chance of fatality being that it's a 130mph collision.
Building a web app to be as secure as possible
If I hired a company to build out a web app that needs to be secure (i.e. a tip line to be used by law enforcement, etc), what would I look for?

For example...

- Is there a 'most secured' dedicated host? (assuming that the machine will not be housed on-site)

- Is there a specific framework/language used more often than others for creating these applications?

- Would transactional messages sent via email (i.e. sendgrid, mailgun) be a no-no?

- Firewall ideas?

- Etc.

I'm sure some of you guys from Palantir could chime in.

Would love to hear everyone's thoughts!
Really fantastic hack. Now try transcribing with just the audio track.
"Velocity Change and Fatality Risk in a Crash–A Rule of Thumb" by Joksch. When collisions result in a Delta-V of 65mph, collisions are on the order of 70% fatal.

The fitted curve predicts the fatality rate to be ((delta-v / 71) ^ 4), suggesting a 100% death rate at 71mph.

Dropping down to 65mph drops your fatalities to 70%. Dropping down another 5mph to 60mph drops you to 50% fatality rate. The 5mph after that is a 36% chance of fatality.

So the 65mph limit is a rather magical number in terms of surviving a worst-case scenario. Going above that, fatalities go up dramatically. Going below that... fatalities are significantly lower.
fantastic. with your permission, i'd love to use this to demo python!
I think he's talking about 65mph delta-V, referring to the change in velocity at the (nearly instantaneous) time of collision. Two cars rubbing like that won't produce a 65mph delta-V in the way that a brick wall will. It might be 5-10 mph, which will be enough to shock people but not fatal. He's right that 65 mph delta-V is almost uniformly fatal.

Likewise, if you jump out of a moving vehicle at 65mph, you'll get banged up badly but might not die, because you don't lose 65mph of speed the first time you hit the ground, since you're hitting it obliquely. On the other hand, if you jump from enough height to reach 65mph and hit the ground directly, you're almost certainly dead.
Sincere question: is the NSA on record for having responsibly disclosed any previous security holes? Is there some track record of them having actively help close security holes in software?
No, speeders would be the people with /insufficient relevant training/ doing that.

If everyone were trained, it wouldn't be so bad... which leads me back to better driver's ed at high speeds, like in non US countries.
Heartbleed–What's Next? Check Your Clients, Routers, Virtual Machines And VPNs
Help me out:

+ Experience in doing web Analytics analysis

+ Experience in doing customer service (I already do it in the corporate world)

Email in profile.
HMO: I've got a FOSS[0] that presents a simple, easy to use GUI for developers to help them create Vagrant/Puppet manifests for local development, and for deploying to hosts like DigitalOcean, Rackspace, AWS.

It's mostly me doing the development, and it seems to be fairly popular. However, I need help with several things!

I need a proper release process. Right now I'm just developing locally, pushing to git then pulling on prod. I want to implement Puppet tests to make sure everything jives.

I need a process to create random VMs using different configuration combinations, to make sure all my options are ok.

I also want to add support for more languages, as I currently have for PHP. Python, Ruby, Node are on my to-do but not really sure how to properly set those languages up!

Contact me on

Skype - jtreminio
twitter - @juantreminio
email - jtreminio@gmail.com

[0] https://puphpet.com
Yes, I can see how your experience can be a valuable lesson to warehouse workers.
Use the bug for what purpose? The NSA constantly lies, and also just spies on non-terrorist organizations because terrorism:
http://techcrunch.com/2014/04/08/snowden-council-of-europe-t.... They are so beyond deserving the benefit of any doubt.
Tinder Valued At $500 Million
So OpenSSL team has opportunity to make $3K profit and not have to deal with Heartbleed-scale shenanigans?
Yes, it's highly contagious. HIV is actually remarkably difficult to transmit (on the order of single-digit percentage seroconversion for sexual acts), but Ebola routinely transfers between patients and caregivers.

That's why doctors treating Ebola have to wear serious containment gear, but doctors treating HIV patients have to wear gloves and maybe eye protection.
Mythbusters did an entire episode on this.

They crashed a 100mph car into a wall, a 50mph car into a wall, and then two 50mph cars into each other.

I suggest watching the videos to visually see the proof. The 50mph vs wall is similar to two 50mph cars crashing into each other.

32mph vs 32mph car would have a very low chance of fatality, although the two cars would probably be totaled. When I say ~65mph as a problem, that is the 65mph vs 65mph cars hitting each other head on... or 65mph vs a tree / wall / bridge (which has an equivalent chance of death)

Remember, the kinetic energy of you and your car goes up with the square of your speed.
Seriously? This is a pretty worrisome disconnect. Having 2k to blow on something like this is almost the definition of wealth to me and is very certainly not fair or productive to society to have things like this.
Yes, it's not considered as large a risk for that exact reason - in the most severe case you simply shut down all transport and wait 15 days
Are we sure this isn't a parody?
Get Work Done: 5 Genres of Music for Unstoppable Productivity
I was actually inclined to give them the benefit of the doubt, but your point actually sort of makes sense. I don't like this feeling of not knowing where the boundary between wacko conspiracy theory and ... y'know ... real life ... begins and ends.
If this is true, and the NSA knew about the Heartbleed vulnerability, then how come the EFF hasn't been getting more log data showing the vulnerability being exploited against sites?

How come, so far, only one person has thus far come forward with ANY evidence that might demonstrate a knowledge of this bug before it was discovered?

I just find it depressing how ready the media is to jump on the NSA for things they may not have done. There's plenty to work with in the realm of things they did do, why draw conclusions before there's evidence? So far I've yet to see a static analysis tool that would have caught this, and I don't have any reason to believe the NSA is hand-searching code for vulnerabilities.
I Don't really have a schedule and i find it really hard to stick to a routine due to problems with getting to bed and waking up the same time every day.

But normally this is what i do.

* wake up between 10:00 and 12:00 take a shower and make coffee.

* Code on a start-up me and my brother are in the making of.

* 3 times a week i hold boxing classes at my dads gym.

* After work i watch a movie or read on hacker news.

Sometime i wish i could get on with a routine and stick with it, it would benefit me in many ways. But my discipline on going to bed and waking up on proper times is none and i have never been able to do that in my whole life, so i don't see it happening in some time.

I have also tried to get back into boxing and marital arts, i used to be really into that and train 5 times a week. But my interest in training and martial arts have almost disappeared as i have been doing it since i was 9 and i have no idea how to reignite the flame i used to have.
Show HN: My Big Huge List Of Useful Websites
They are committed to privacy, he just stated so in the link.

Just that they aren't SpiderOak and aren't going to encrypt all of your data client side before uploading it. That would require changing their entire architecture and they aren't going to do so.
NSA was not aware of the recently identified vulnerability in OpenSSL, the so-called Heartbleed vulnerability, until it was made public in a private sector cybersecurity report

Or perhaps the "private sector cybersecurity report" was a IRC chat two years ago for l33t haxors.
I am utterly baffled by the fact that people are still posting that link as if it proved anything other than the fact that Joel Spolsky has absolutely no idea what he's talking about.

Or has this now become a running joke? Was the posting of that link ironic?
Or they didn't.

See, now we have complete set of possible answers! So, what does it means when NSA officially announces something? I'd say, it means nothing.
I would ensure it's at least of as good of quality from the Subreddit Male Fashion Advice: Getting Started

Simple Step-by-step Intro (http://redd.it/1laa42)

How Clothes Should Fit (http://redd.it/ehrtv)

Building a Basic Wardrobe (http://redd.it/12gfbv)

Understanding Color (http://redd.it/15tjgv)

Building Outfits That Work (http://redd.it/19qc8c)

I've got $X. How do I spend it? (http://redd.it/1gspr6)

Developing Personal Style (http://redd.it/17mn5x)
I don't know the answer to your question of whether other countries fund development of Marburg or Ebola treatments.

I believe at the time the DoD funded it out of pure national self-interest: regardless of geographic proximity, just one infected person on the wrong flight could present a massive national security risk.

To be fair the DoD did continue funding Ebola cures with Tekmira, and Tekmira earlier this year began dosing of the first human patient. That patient is healthy and the dosing is to test the safety profile of the drug. Reportedly the WHO has not requested any emergency supplies of Tekmira's drug yet.
Maybe they are just being "least untruthful".
Yes, that's wrong.

Empty comments can be ok if they're positive.

From http://ycombinator.com/newswelcome.html
Or 4. She understand sDropbox's commitments and has committed to advise them how they can act in accord those commitments while simultaneously believing that NSA surveillance is justified.

That is quite believable. Heck, lawyers do things like that all the time--advise someone on how to act in accord with that person's interests and principles, even if those conflict with the lawyer's interests or principles. This ability is not limited to lawyers. Besides lawyers, this is often done by people who manage the financial accounts of others, by people who manage the health care of others, and by people who accept positions as outside directors on the boards of companies.
You can, but:

A) Legitimate libraries don't (unless the IO action is in fact pure)

B) Rogue libraries that do this will not generally work: laziness, optimizations, RTS races can all make the IO action run 0..N times, arbitrarily.

C) It doesn't change the fact that in Haskell, the XML library exposes the weird XML behavior of looking up external entities by being in IO (my original point) -- because of A.
Heartbleed and the Problem with Free Software
I find this to be disingenous on CloudFlares part. First of all their configuration is almost irrelevant. The heartbleed.com guys did in fact recover key material without much effort.

I really dont care what cloudflare thinks they know about heap allocation in THEIR one trick pony configuration.

its irrelevant to the problem at hand. Sadly another example of CF grandstanding to appear smarter than everyone else with little to back it up.
I do see the distinction between open source and free software, but I'm not sure it applies here. This bit of your comment particularly:

They tend to disregard ideology and instead believe OS is the rational decision of those who want technically better software.

If ESR is writing software in the way he thinks results in better software ... how come I know who he is? Because he's not doing that, he's doing more than that.

I don't know if he prefers working in the mornings or evenings. I don't know how he backs up his work. I don't know whether he prefers a laptop screen or an external display or who he trusts to contribute to it - presumably he made rational decisions there for the benefit of his software, and didn't feel the need to tell the world all about it.

Yet when it comes to open source, he does more than "choose the best option for his software and use it", he also: spreads the word, advocates for it, tries to convince others. Wikipedia says "Raymond was for a number of years frequently quoted as an unofficial spokesman for the open source movement."

By contrast, there is no comparable "closed source movement" which organizes conferences and runs websites and talks to journalists and advocates in favour of closed-source development because it makes software better. There's no popular closed-source unofficial spokesperson I can point to whom you recognise.

I argue that people pushing "open source produces better code" are making that an ideology of its own, separate from anything to do with Stallman and 'free as in speech'.

And it's that ideology of 'Open Source leads to technically better software' which Heartbleed is showing up as weak and oversold. You agree that it's "not always true". My point is that Open Source proponents make it seem like should be "always true", like there's a very strong case for it. And I say that Heartbleed shows there isn't.

'Everyone' knows about bounds checking in C. Everyone knows about not trusting input from a remote machine without verifying it. Everyone knows about being extra tip-toe careful around cryptography software because it's high importance and brittle. What did OpenSSL do about it? Nothing.

Almost as if Open Source made no difference at all, and what matters about developing trustworthy software is people, welcoming communities, a thousand cultural decisions setting and holding patterns of procedures to systematically catch common errors in C, common errors in network code, common errors in security, common errors in memory managment, add regression tests, encourage documentation, add compliance tests, etc. etc.

Open source does not automatically lead to better software.

And many people strongly imply that it does, automagically, lead to better software.

(The fact that OpenSSL still became popular and widely used despite being a mess is if anything a win for 'free as in speech' - anyone can do any due diligence they want on the OpenSSL code, make their decision to use it for any project, fork and patch and modify it as they go. On that front it's a massive win for that ideology).
This policy is specifically designed to weed out all but the most desperate employees. When you're living paycheque-to-paycheque you can't afford to strike. The reason I pay union dues is to top up that strike fund.
You made me think for a few more moments on the issue.

The reason 2 cars hitting each other is similar is more due to their mutual crumple zones, so they're helping each other slow down at the same time.

I suspect this would also be dependent upon the car, since newer cars have better crumple zones to help survive accidents better. There's a lot of details that go into actual damage. Most people, when they're in an accident, don't go headlong into a wall. They hit a pothole and spin out, or nudge another car and go spinning, or hit a side wall at an angle, where their speed toward the wall isn't actually 65 mph, and so on.

At the end of the day, it's not that 65mph is the near-death number, as far as car speed is concerned, it's more, as everyone else has been saying, the delta-v. The easiest way to hit 65mph in that way is hitting a tree head-on, or wall head-on. On the freeways, this isn't likely the case, and even the edges of roads where two roads split and there's a barricade are protected by several crunch zones in the road itself.

Edit: ah, I didn't notice that you had been saying delta-v as well. Either way, I still think I follow what you're saying now
The cool part is that you can actually measure how weasely are those weasel words: As other security experts have pointed out here, the NSA's hoard of zero-days is numbers in the thousands. How many times have they practiced "responsible disclosure?"
> From my memories, a devil would be interpreted as a demon so they might be able to give you limited abilities if they happened to be particularly powerful. But not the full abilities a god could provide.

That's how I understood it as well. In the base AD&D 1st Edition, you had a cleric and no other backstory. There wasn't a backstory to go with the game, it was just the base rules to be applied to any world. Then there were different worlds which came later in expansion sets.

In Forgotten Realms, I believe your cleric could get certain unique powers based on which god your priest followed. For example, if you followed the god of magic, you would gain the ability to cast minor spells as you gained levels.

I also seem to recall the same info about following a devil. I believe you could follow certain major devils (probably had to control their own "circle" of Hell) but that you actually took a hit to your powers. Because these beings were less powerful than gods, you got less powerful abilities.

I imagine this was much the same no matter what expansion you went with. You needed the expansions to get a backstory and fill-in for the "lore." It's was a bit of a strange situation. There were specific gods for each setting, but each setting had access to the same "planes" with Hell being one of those. The way I remember this being setup is that each setting had a different world but they all literally shared the same planes. A Dragonlance player might actually be able to meet a Forgotten Realms if they bumped into each other in the planes. I think this was all intentionally left a bit blurry because it wasn't fully fleshed out.
Hard to say. Most hospitals are not prepared for (and don't expect) a disease like Ebola to walk through the door. So while we have much better standards of cleanliness and isolation than a hospital in sub-saharan Africa, we're still likely to be taken by surprise by a patient who presents with a bad fever.

The worst case is that someone gets infected and flies to a major city before they get really sick. You could have a huge network of transmission before it ever hits a hospital.
Is there any convincing you that second amendment rights should be treated in parity with first, fourth and fifth amendment rights?

If not, I wouldn't be able to vote for you, but I wish you luck regardless.
Or they just didn't know. Seriously, if you divide the world into the NDA and the non-NSA, then why would the former be much better than the latter at finding vulnerabilities in open source software?
Controversy flares as Condoleezza Rice joins Dropbox board
The purchasing department is the last place you'd want to call - purchasing is department people in the org. go through to buy things, not the other way around.

You'd either want to talk to some senior in IT security or anyone above them, upto including the CTO or someone in risk management/liability. Doing sales to those people is most likely expensive, probably costing $10k+ per client which would be the cost of someone going to networking events, visiting prospects, presentations, documents etc.

In my experience paying yearly is much preferred to paying monthly in large orgs. due to the process that has to be gone through to purchase something (Longer than a year can cause budgeting problems).