skysight-inc/HackerNews huggingface dataset:
Is it that debate (even as devil's advocate) is structurally limited when participants self-select for willingness to act?

That dynamic reminds me of the bias labeled "sympathetic point of view" as described in the essay "Why Wikipedia is not so great": "Articles tend to be whatever-centric. People point out whatever is exceptional about their home province, tiny town or bizarre hobby, without noting frankly that their home province is completely unremarkable, their tiny town is not really all that special or that their bizarre hobby is, in fact, bizarre. In other words, articles tend to a sympathetic point of view on all obscure topics or places."

That is surely not how we want decisions made about TLS.
I consider modern C++ to be a lot safer than C. Between RAII, copy, and move schematics the pointer use has gone down quite a bit.

When you do use pointers, we finally have a real null pointer literal now. (I believe the latest C spec has also received this.)

C++ is certainly crufty. The language has been around for a long time and many features in the specification exist to support legacy code. This is a side effect of being a living language with a huge user base.

Modern C++ tends to be fairly clean and reasonably easy to work in. Herb Sutter has some great talks and blog articles around the topic. For example: http://channel9.msdn.com/Events/Build/2014/2-661
There is waste with thorium reactors as well, so they need to be well run by competent people just as a conventional reactors. That said, the waste is easier to handle for several reasons, particularly in the liquid fuel type.

The waste in conventional reactors are of two types, fission procucts and higher actinides. The fision products are the result of splitted uranium atoms. These are intensively radioactive, with halflives from milliseconds to about 30 years.

Then there are higher actinides, with halflives up to tens of thousands of years. These are less radioactive, but still radioactive enough that they have to be safely stored. This storage must be safe for hundred of thousands of years, something that it is hard to guarantee. Fision products only need to be stored for about 600-800 years before they are no more radioactive than uranium ore. Thorium rectors produce virtually no higher actinides, so it is easier to find storage that is safe for the period it must stay out of reach. It is also less volume of the waste (but more concentrated, as the amount of radioactivity is about the same), since the fission products are not mixed with U238 as in conventional reactors. This means that less storage is needed, which also makes it easier to handle.
An excellent explanation. Thanks.
If I parse Theo correctly, he clearly says that FreeBSD does have a hole.

Its really really hard to imagine he is lying.
I still don't see the big deal with iTunes and iPod's. ipod is a great product, but there is no real killer feature; "plug it in and it just works", yes, if you have iTunes. Meanwhile, plug in any decent mp3 player of that time\* and it Just Works, assuming you just have a file system - drog and drop the files you want into the mp3 player.

Maybe you could say that ipods with itunes is simpler than dragging and dropping like that. Though I don't see much of a diffrerence; drag and drop is a common action in Windows and the like. In order to selectively add files to your ipod you'd need to learn to drag and drop... in iTunes.

iTunes is an okay-to-annoying program, at least on Windows. I've bought music on itunes that I have to "enable" on every new PC I might use. The last time I tried it dodn't even work. I
ve bought an audio book that I have never been allowed to even play! iTunes can't (or couldn't) even compete with pirated media, not by a long shot.

\* let's say when mp3 players had a capacity that actually made them worthile, maybe as small a capacity as 256MB, or 512 and more.
This is such an unbelievably good post. Bravo, and welcome to HN, if you're actually new here.
Yes, but difficult. SaaS is/was supposed to be a different way to sell to enterprise. Transparent easy to understand pricing. Then the enterprise and, more specifically, procurement, stepped in. And they don't care about transparent pricing - their job is to get the price down. Thus, they don't buy online - they want to negotiate (and they want three vendors in the mix) - and the whole model goes right back to where we started.
Sure, it's simple if you realize that memory heaps are sequential and the server's private key can be found after the address of a short-lived packet buffer... It is not trivial explaining all that with simple analogy my grandmother would understand.
There's also the question of how much of the electricity is paid for. E.g. how many miners are mining on "free" electricity at their parents house, or have access to rack space with "free" electricity (our racks at work come with a certain amount of power, for example; someone putting a Bitcoin mining rig in there would not increase our costs as long as the power doesn't exceed certain limits), or has a miner in a quiet corner at work or similar?

Or any number of other ways of getting free / outright stealing electricity.
Blogging – Between a rock and a hard place
In the past pre ww2 board games sometimes used to come with spinners or other means of random number generators due to dice's asociation with gambling.
The laser tech that could purify dirty water in developing countries
Scientists have been able to generate this ultraviolet light for over 100 years but the technology has changed very little and still requires fragile glass bulbs filled with gases which are sometimes toxic. This is something which Smeeton aims to change by replacing the gas-based lamps with LEDs and lasers. There are numerous applications for this light: for example, it could be used as a simple and effective way of purifying drinking water. There are also plans to use the light in sensors to detect pollution in air and water as well as for medical diagnosis.
Haha. Your comment is so complex it needs another XKCD comic just to make sure all those [-1], (2), 1., [1]'s etc. don't get mixed up.
Show HN: MEO Wallet
Sorry, I'm not limiting the discussion to SSL vulnerabilities.

A remote code exploit is as bad as a memory leak.

I posted these two: CVE-2013-1493 and CVE-2013-0809 in another reply. These 2 were memorable to me just because visiting a page (or a compromised page) would allow the exploit to proceed without any password/prompt/warning.
> I understand needing a unique identifier to distinguish between heartbeats ... but why conflate the heartbeat with Path MTU, which is an orthogonal process.

The only people who can accurately answer that are the author of the RFC/code, and the TLS committee members who discussed the changes.

From a security standpoint, it is more dangerous to commingle the two, because a bug in one side (path MTU) will also effect the other half (heartbeat). And that is exactly what happened.

> Why absorb this function into the OpenSSL pacakge?

Unknown. Path MTU discovery is supposed to be handled at a low layer in the OSI network stack abstraction (closer to the physical hardware) such that higher level layers/apps should not need to care. Putting it into TLS the protocol is a blatant layering violation.
From the outside it looked like the churches that where aginst DnD where fringe protestant sects.
> Please ask Kirk McKusick, he knows the story about why this is not being disclosed to FreeBSD

Could someone please explain this?
Async Web Apps for the Masses: Running Vert.x on OpenShift | Openshift Blog
Nice easter egg in the user who wants to change the password to CoHoBaSt (correct-horse-battery-staple).
Would you not assume that the entire OpenSSL library would count as being in need of extra scrutiny? The point is that any time you let people directly access memory, they can, and often will, screw it up.
How was "In Nomine" recived in france aprently it was far more anti religion than the English version.
> every time I write code to parse some XML

Why would you write code to parse XML?

Use an existing parser to parse.

Use XSLT to modify/transform (including generate JSON/CSV/other).
Just $10k?

This sells for at least 10 times more on the black market. Why would one rationally chose to "sell" this to google instead of the black market.

Some people don't break the law because they are afraid to get caught, but I like to believe that most people don't break the law because of the moral aspect. To me at least, selling this on the black market poses no moral questions, so, leaving aside "I'm afraid to get caught", why would one not sell this on the black market? Simple economic analysis.

Very serious question.
The author probably thinks that all versions are equally fast, but in fact they are just equally slow. Neither gcc 4.8 nor icc 14 can use vectorization for this loop (likely because of aliasing).
Zeroing memory does not help in the general case unless you allocate an input buffer large enough that you can never overrun it; otherwise you can still hit whatever follows your input buffer.

If the input buffer was guaranteed to be large enough in this particular case I don't know but I can imagine an implementation that does not allocate the buffer for the 64 kiB worst case but just large enough to contain the actual request.
Because they are a legitimate company that sells security services.
Lol watch the new BBC Musketers series and see how Cardinal Richelieu views violence and power.
And yet, those are frequently described in the bible; lots of violence in the old testament, some in the new, and again lots in the post-biblical eras; personal power, I'm pretty sure God is the pinnacle of that; the kings in the old testament another (they (re?) conquer Israel of all things), Jesus yet another (cult/religious leader). Occult, I don't know what falls under that, but plenty of talking to the dead / satan / higher beings there.
Nginx Anti Xss and Sql Injection.
Perceived chance of being caught * cost of punishment.
They made $10k plus a huge amount of free advertisement for their company and services (security). I reckon this release alone will earn them far more than your estimated $90k difference.

Mind you, your point is certainly valid if this were a random hacker type.
Ah, then I have misunderstood; I apologize.
I think you're drawing the wrong conclusion from the download correlation. There are tons of companies that offer their products as downloads that don't have the success that Atlassian has.
> If the input buffer was guaranteed to be large enough in this particular case

It was, since it used the same size to allocate the buffer and call read(2) it would never put more data than expected in the buffer.

> otherwise you can still hit whatever follows your input buffer.

Yes, but that's not the issue in heartbleed. My comment was about heartbleed, not about covering all the ways in which you can fuck up memory access in C.

> I can imagine an implementation that does not allocate the buffer for the 64 kiB worst case but just large enough to contain the actual request.

"just large enough" is impossible, you'll always over-allocate by at least 1 byte, and then to get the actual best precision you have to read the input data a byte at a time, performing a read(2) per byte. That's both slow and less readable.
Things like this do happen, unfortunately.

http://en.wikipedia.org/wiki/UCKG#Victoria_Climbi.C3.A9.27s_...
Who is this meant to be of interest to?

Is HN turning into Twitter? If so I've got a great link where someone discusses his reasons for choosing which pair of socks to wear.
That's because it was the in-depth, technical explanation of the comic. Based on the GP's comment, the comic is exactly accurate.
It's bad practice to fetch an external DTD on a server you don't control, first for security reasons, second because your application then depends on something that can go away anytime, third because it's rude to the third party.

twic is right that one should always use entity resolvers that point to local ressources and that parsers should run in a sandbox without external access.

He's also right to say that by default parsers shouldn't go fetch external resources; I think the reason is historical; entity resolvers appeared later than the parsers themselves.
Not really. If A. Shamir's paper is correct, that 98% of BTC belong to 2% of portfolios, then sure as damn they can manipulate the market short-long-for ever term...
> It's just a shame there's no readily available vehicle for playing BTC on the short side

In the UK at least there are multiple firms letting you buy/sell BTC Contracts For Difference, including shorting with a 10% initial margin if you really feel like taking crazy risks. (Plus500 is an example)
If you want to look at it rationally you have to factor in the risks you are taking by selling it on the black market. These risk include:

- How will you whitewash the money? Alternatively how will you spend them on the black market? You can't buy houses, cars or stocks with black money.

- Will you get paid? - Secure anonymous payments that are guaranteed are not trivial. I don't know if there are escrow services for the black market, but this is definitely risky. We are talking about shady actors after all.

- Will you get caught? If do you will probably end up in prison.

When you take the above in to consideration I think most people would prefer $10.000 legitimate US dollars without risk to $100.000 that might end up giving you ten years behind bars.
Surprised that Eu law doesn't restrict the use of non competes - must rember to ask about that as I am due a refesher course on employment law.
I don't agree with you that "selling this on the black market poses no moral questions"; this gives access to Google's production servers, which can really harm Google in very bad ways. Unless Google has done specific very bad things to you and you want retribution, why would you do that to them?

But I agree with you that $10,000 doesn't sound like much, for such an exploit, and for a company like Google.

Edit: corrected typo "$10" -> $10k.
"Changing picture" = "Make a significant difference in the current financial health or structure of Medicare". In other words, let's say you can change that number to lower it by 25%. Now you've affected 3% of Medicare's cost - hardly the main problem.
Running JavaScript in an iOS application with JavaScriptCore
Can someone explain why Heartbeat needed to return the text it was sent, rather than always returning an "OK" message?

What advantage does returning the text give you?
LHC finds New Form of Matter – Z(a tetra quark)
Yeah, I get that. My issue is with them/their system messing up, and them taking the time to email me and admit it was them/their system, "We take responsibility for this technical glitch," but expect me to pay for the billings that have passed between me canceling my service and now.

I am interested if they've done this to anyone else?
[...] why would one not sell this on the black market?

Because it is wrong to harm others for personal benefit?
That landing page isn't that well written.

"expelling the excrescence and allowing your graceful prose to emerge. "
Deposit Freeze at Chinese Exchanges Drives Bitcoin Price Below $400
> it's simple if you realize that memory heaps are sequential and the server's private key can be found after the address of a short-lived packet buffer…

Your comment seems to imply an out of bounds access (read past the allocated buffer), but heartbleed has no out of bounds access.

Instead, it's a problem of malloc (and even more so openssl's freelist scheme) returning non-zeroed memory which can (and often does) hold previously allocated data combined with read(2) not overwriting the whole buffer and not checking read(2)'s return value, which means the aforementioned previously allocated data gets sent back.
What good reason could their possibly be for not disclosing a hole to FreeBSD? Especially if it effects networking infrastructure....

1. Government gag order? I'd call this a "good reason", but it wouldn't clear my conscience.

2. Disclosure to or interception by malicious parties? I can't imagine that the best solution would be STO.
sleep. exercise. jog. swim in the ocean. cook. spend time with friends.
Very cool hack. Is $10,000 around the top end of what Google will pay out? This seems like quite a serious bug as far as they go.
I'm guessing it is of modest severity, if they even feel they can _get away_ with keeping it to themselves. But its still deeply troubling.
Maybe this weird and obsolete service was run on a small subset of servers that is not really worth that much. I would assume your journey would end up right there at that one (or n of the same) machine.
Other musings....

Remote options:

* Connect on demand
* Low bandwidth mode
* Offline mode

Shares:

* Share file/directory (and some kind of authentication mechanism)
* Resource uris
* Show public shares
* One time downloads
* Expiring downloads

Version control:

* View log/history
* Retrieve older version / Roll-back
I think this is a good demonstration of the limitations of static analysis - for a language like C, there will always be bugs that can't be found statically.
I think cheald probably means writing code to invoke a parser to parse XML. Presumably if you had written your own parser (generally, not a great idea) the resulting behaviour would not be "scary, twisted"... [at least to the person writing the parser].
> Government gag order

I can't imagine a government gag order that allows you to publicly hint that there's a problem.
This is the best course I've ever seen
It's not a good reason that they aren't disclosing, it's a personal reason.
It verifies that you're actually connected to the server and it is listening to you rather than just some dumb box that keeps nodding and replying with "OK" with glazed over eyes regardless of what you say.
Show HN: angular-cog declarative ajax requests for angularjs
Novo Regime de Ordenamento do Território e Urbanismo em Seminário
"The future of personal transport".

Is it? Is it really? I skate but this certainly isn't the future of personal transport.
He very clearly said 'write code to parse' not 'write a parser'. The former obviously USES a parser.
Heartbleed links tracking
We are collecting all the links regarding Heartbleed to cover what happened, and what´s happening. Suggest yours, thanks.
Workflow tools for Front-end developers
> They shouldn't do this by default: they should instead take a programmer-supplied entity resolver and call into that.

Then the programmers would write their own resolvers with even more bugs most probably. You would have 10 000 broken implementations of that code, half of them copied from stackoverflow example with security left as exercise for reader.
Do we need to shove religion into this debate about technical matters?
It could be that they plan to tell FreeBSD - and therefore expose what they've found, now they've suddenly started auditing OpenSSL consumers - only when they have a fix?

It could be best fixed in OpenSSL itself, and only affecting those using the compiler options or SSH configuration that FreeBSD ships with.
Strong, Unique and Memorable Passwords: a Creative Approach
Your economic model does not take into consideration the value of recognition, which is a very high motivator, often more important than money.

If they sold it on the black market, they couldn't brag to anyone that they hacked google.
Thanks to Java 8 Streams, the ORM era may have ended
That's precisely the point that riles our tinfoil-hated
friends: Heartbeat should be a simple matter of hi-ho's
ad infinitum (ie: no or constant-space parameters).

This is, of course, glossing over the fact that TLS over a TCP link doesn't actually need a heartbeat. TLS/UDP does,
granted. Ever heard of DTLS?
So instead you could be communicating with a marginally less dumb box, which nods and replies with whatever you said instead?
Unpakt.com is pretty good for this, though they index only professional moving companies. You enter the general stuff you're going to move and they compare prices across a bunch of providers.
What I find painful about writing pseudo-functional C++ using <algorithm> and other tricks is that you have to allocate storage for intermediate values. This makes C++ algorithms a lot less composable than similar things in other languages.

So if I wanted to do something like (in Haskell):

sumOfOddSquares xs = sum . map (^2) . filter odd $ xs

In C++, I would need to allocate temporary storage for the intermediate values.

std::vector odd_numbers;
std::copy_if(xs.begin(), xs.end(), back_inserter(odd_numbers), isOdd);
std::transform(odd_numbers.begin(), odd_numbers.end(), odd_numbers.begin(), square);
std::accumulate(odd_numbers.begin(), odd_numbers.end(), 0, plus);

This becomes quite painful very quickly. You can use solutions like boost::filter_iterator, but soon you're knee deep in C++ templates and the long compile times and awful error messages that follow.

The example above is a bit contrived since it can be easily be done with a single accumulate, but you get the idea...

std::accumulate(xs.begin(), xs.end(), 0,
[](int sum, int i) { return sum + ((i&1) ? i*i : 0); });

So while you can have lots of fun with <algorithm>, it's quite limited in what it can do.
Looking for more serious bugs? It could be the first steps on a major privilege escalation.
Show HN: New CV Building website needs people to play and test it.
I'd be curious as well.
Oh, I'm not dismissing Rust. I think my overall point is that nothing is ever going to perfect. Plan for imperfection.
It's $10,000, not $10. Detectify is based in Europe where they use . to group digits.
A few webcrawlers[1] out there follow HTTP redirect headers and ignore the change in schemas (this method is different of OP's but achieves the same goal).

So anyone can create a trap link such as

<a href="file:///etc/passwd">gold</a>

Or

<a href="trap.html">trap</a>

once trap.html is requested the server issues a header "Location: file:///etc/passwd"

Then it's just a matter of seat and wait for the result to show up wherever that spider shows its indexed results.

[1] https://github.com/scrapy/scrapy/issues/457
Can you explain what led you to post this on HN? Maybe the Skype team are regular contributors here - I don't know.
Quick, Vital Tip for New MongoDB'ers
“Apple takes security very seriously. IOS and OS X never incorporated the vulnerable software and key Web-based services were not affected,”

This makes it sound like they knew about the vulnerabilities, which they didn't...
No,

You can see the general payout levels here: http://www.google.com/about/appsecurity/reward-program/ , normally the top payout is about $ 20,000, but the top payout (for Chrome) currently 2 people have been rewarded with $ 60,000. There is an overview of the top payouts though: http://www.chromium.org/Home/chromium-security/hall-of-fame.

Some payouts are $1337 ,$3133.7 or $31336 :P

Microsoft rewards even up to $100.000 for security issues in the latest OS (currently Windows 8.1)
This has puzzled me too. The RFC that describes the extension [1] seems to be silent on the actual rationale for allowing an arbitrary message.

All I can think of is that the designer of the extension wanted to specify a mechanism with enough extensibility to allow requester-generated sequence numbers with arbitrary formats to be sent. Alternatively, if the sender makes the message unpredictable and compares the request and response messages and finds them the same, then this provides some weak "proof" that the responding server is the one that the request was sent to.

I don't find either of these particularly convincing though.

[1] https://tools.ietf.org/html/rfc6520
AFAIK the US federal government (excluding the military, which obviously has its own hoops to jump through) generally can't use your hardware/software unless it has the appropriate FIPS certification(s). https://en.wikipedia.org/wiki/Federal_Information_Processing...
The commit message contains a rather succinct, albeit drastic description-cum-definition of Heartbleed:

> [A] 64K Covert Channel in a critical protocol.