skysight-inc/HackerNews huggingface dataset:
I know Colin likes to keep commenting that the simplicity of spiped makes it inherently more secure than more complex alternatives. I haven't evaluated the code, nor done a study to see if the number of lines of code always correlates to number of security holes, or if the complexity of the operations compared to the number of lines is related to the number of security holes, and what the bounds of that are. But I just took a brief look at one file and saw this:

/* Generate a 32-byte connection nonce. */
if (crypto_entropy_read(H->nonce_local, 32))
goto err1;

/* Send our nonce. */
if ((H->write_cookie = network_write(s, H->nonce_local, 32, 32,
callback_nonce_write, H)) == NULL)
goto err1;

/* Read the other party's nonce. */
if ((H->read_cookie = network_read(s, H->nonce_remote, 32, 32,
callback_nonce_read, H)) == NULL)
goto err2;

The gotos themselves aren't harmful (even though I don't get why people still use gotos). What strikes me as really funny about this code is its over-simplicity is what caused a huge crypto bug to be missed in Apple's iOS 7 recently. Take a look at the above code and then this security hole[1], and tell me if you can't spot a potential problem.

[1] http://www.wired.com/2014/02/gotofail/
How feasible would it be to write things like nginx, Apache, web browsers etc. so that they can use both OpenSSL and NSS, where you could choose what to use via config switch? Then it would be easy to "fix" such a bug when it occurs. The probability that both libraries have a vulnerability at the same time is probably very low.
errcheck will add this as an optional linter. I've adjusted the git hooks on my machine to run errcheck and fail the commit if it doesn't pass (unless I specifically disable it).
Both of them are outraged.
They didn't actually imply that try/catch was a solution, they just said there has to be a better way.

For example, Option types...
The "huff" is that this forum is the attempted community fork of Slashdot that even less people care about.
There is a better way. Check out how Erlang embraces failure with its "let it crash" philosophy, and considers trying to handle every error condition manually ("defensive programming") an anti-pattern. Read the "Error handling philosophy" section of Joe Armstrong's thesis[1] if you want to learn more.

[1]: http://www.sics.se/~joe/thesis/armstrong_thesis_2003.pdf
Your whole premise is founded on there somehow being intrinsic value in a more even split in gender in software engineering, are there not neurological/biological differences between men and women that could explain at least some of the disparity? Never even talked about on here by the gender activists
One of the reasons Mixergy took off is the Hacker News community helped me.

I used to call up people who complained about my work on HN. I wasn't mad at them. I really wanted to get feedback, and I knew there were smart people on this site.

I got my guests from here too. Somewhere in the comment archive, you'll see Derek Sivers agreeing to do an interview because I responded to his HN comment about offering to help people in this community.

When I moved to Argentina and didn't know anyone, I organized a Hacker News meetup. I made more than startup/work friends. I met people like Chad DePue, whose family became close with me and my wife.

I know we talk about improving the comments on HN, and I'm always for improvement, but there's a huge amount of value here right now. And there has been for years.

I know this could sound sappy, but thank you Hacker News.
The lawyer made a video that was very anti-Tesla:

https://www.youtube.com/watch?list=UUaelOgVXLe-1a3PUpob3upQ&...

Should Tesla have to just sit back and wait, while their name is being (probably unfairly) dragged through the mud?
The Author touches on a lot of nice points, but does not address some of the problems with using Go.

Anecdotally, from using Go for a number of projects...
As a rough approximation, I think Go's marginal return tops out at about 1000 lines of code. Past that point, syntactically it is hard to do abstraction (interfaces or generics).

As a result, I use it for scripting but not for larger projects.

What about you all?
Customers aren't always idiots. However, there's a special kind of engineering idiocy that thinks that having a humidity sensor in a phone is a great idea.
Andrew's one of the most accessible, down-to-earth chaps in the tech worlds; an empathetic, thoughtful, engaging and energetic collection of decency! I'm an old friend from another place, so I'm biased, but if you get the chance go and hear him speak, and even more so listen to those around him: because Andrew's great skill is to gather creative, intelligent and constructive creatures, and encourage them to be even better.
Why the Singularity Might Not Happen: Predictive Apocalypse Analytics
Because most people really, truly, honestly don't need the shit they think they need; they just "want" stuff more than they "need" it. Adopting this mindset helps you have cushion for catastrophic problems if/when they arise.

And typically the number one thing that negatively affects a person's financial situation is the state of the national/global economy, that is, something entirely outside their immediate control. Thus having a nice cushion for something outside your control is a pretty good idea.

Watch Robert Shiller's OpenYale courses. They're amazing. Particularly the last one* in which he mentions that, to reiterate, that most financial problems most people face are economic circumstances completely outside of their control. The causes of which are financial institutions inability to properly deal with risks which then causes massive economic inequality that we see today and which is growing larger more so today than it ever has in history.

*http://www.youtube.com/watch?v=2_pDTWgJg94&index=24&list=PL8...
It's absolutely true. To the degree that your objection holds (which isn't negligible), it places some limits on the return possible from 1. 2 still fully applies. I'm also not sure what the limits in 1 are, when what we need is more careful code and better analysed code, rather than more code. "Find problems" shouldn't involve tremendous amounts of communication overhead.
Yes, if you totally throw away the type information, then Go will let you write some generic code. Your library uses a _ton_ of `interface{}`, because it has to.
Think about the target audience for this show. It makes perfect sense to try and reach out to them like this to get them hooked.
I don't think he'd refute that he'd have more to worry about had he not been lucky enough to be on an unaffected version of OpenSSL. I believe his point was that the use of stunnel to terminate SSL connections mitigates some of the attack vectors that could've been used to recover customer information in the event of having been compromised at the OpenSSL layer, and that the architecture of Tarsnap itself absolutely precludes recovery of customer backups in any event. And that these facts aren't an accident.

The important takeaway from this post is that it pays to employ layers of security when building software systems.
Same here. Good support in LiteIDE. Debugger works from LiteIDE. Been meaning to try this LightTable plugin (https://github.com/toqueteos/LightTable-Go) but haven't gotten around to it yet.
That's basically S3 actually.
I wonder if he's still unemployed.
add https://github.com/kisielk/errcheck to your continuous integration process.
That's pretty reasonable, yeah.
Bought! Thanks for sharing! It is always a source of stress and annoyance to me how long it takes to make and maintain slides for coding presentations in Keynote, so I'm looking forward to the next opportunity I have to use this!
Someone burning out from hiring whites? I've never heard such a thing. I doubt that Google looks at its stack ranking and says, "Wow, we have a lot of white underperformers". That was one of my original points -- whites are almost never judged on the basis of race, whereas others are. You seem to be confirming that fact -- but trying to justify it.

Race and gender are both protected groups, although treated differently. There are laws in place meant to stop the type of discrimination that you seem to want to justify.

Contrived examples are not useful. Maybe we'll find out that Asians can cure cancer by touching people -- sure then I'd prefer they become oncologists. But in the real world what you do is test/interview for skills, and sometimes you'll see data that disproportionately over/under-represents a group. That is fine, and that is good to discuss. You'll often find that this bias is due to some other factor.

Simply discriminating because your miniscule sample (and likely media/culturally induced bias) gives you a bias, is almost the canonical definition of racism.

There was a time in my lifetime that Blacks were not considered smart enough to be quarterbacks. The data seemed to support it (when Doug Williams was drafted, there had been a total of 11 Black QBs in NFL history). In less than a generation we now have Blacks overrepresented in the NFL as QB (as compared to the population, not as compared to Blacks in the NFL). And another Black QB won the Super Bowl, largely viewed as one of the smartest players in the game.

The good thing is that sports tends to really favor skills assessment over the long haul (the scoreboard is a pretty good reflection of quality). Except in the most exceptional cases, I'd suggest others do the same.
It sucks and I feel for Amy.
Then again, she did make 60K a year for period. As a designer. And 10K isn't much but it's enough to buy a few nice things.

Really, I guess I don't feel that sorry. People work their hearts out all over the world for little more than subsistence. Work and business is brutal and full of millions of sad stories.

The level of self entitlement displayed by the "startup culture" is astounding at times.
Longreads Joins the Automattic Family
Soylent News!

Really, Slashcode is just unbelievably horrible. I ran it myself. It's stupidly fragile, you can break it by altering things in the interface and it stores its weblogs in the MySQL database.

I eventually moved everything to WordPress and stopped wanting to STAB MYSELF IN THE FACE REPEATEDLY whenever I wanted to make a post.

Slashcode is not my favourite CMS.
To expand, Go's type system is relatively rudimentary. The lack of option types[0] leads to this fairly common, verbose Go pattern:

func DoFoo(Foo foo) Cat {
bar, err := GetBar(foo)
if (err != nil) { return nil }

baz, err := GetBaz(bar)
if (err != nil) { return nil }

cat, err := GetCat(baz)
if (err != nil) { return nil }

return cat
}

Option types add metadata to a type, essentially combining `bar` and `err` into a single variable. Let `Maybe x` mean a function will return `Something x` or `Nothing`. For example (in hypothetical Go):

func DoFoo(Foo foo) Maybe Cat {
bar := GetBar(foo)
if (bar.(type) == Nothing) { return Nothing }

baz := GetBaz(bar)
if (baz.(type) == Nothing) { return Nothing }

cat := GetCat(baz)
if (cat.(type) == Nothing) { return Nothing }

return cat
}

Since this is such a common pattern, Haskell has a bind operator (`>>=`) to take advantage of option types by passing the output as the input of the next function if it's a `Something`, or return `Nothing`.

func DoFoo(Foo foo) Maybe Cat {
return GetBar foo >>= GetBaz >>= GetCat
}

If you care about why something failed, use an `Either` instead of a `Maybe`. In a language that supports algebraic data types, you could create your own sum type instead.

[0] https://en.wikipedia.org/wiki/Option_type
Any links to specific threads? I don't find anything when searching that list for "revocation" or "revoke", though there seem to be lots of threads about CAs in general, so maybe there's relevant discussion in some of those.
A quick google search indicates that Greg Christie came up with the "Slide to Unlock" idea: http://www.macrumors.com/2014/04/09/greg-christie-jony-ive-f...

Hopefully the person that invented the picker wheel control will be next. What a horrible interface.
I really tend to struggle with Tesla whenever I read these kinds of things. On the one hand, I generally feel like they tend to shed light on areas where customers, the media, politicians, etc. are messing with them. On the other, something about the tactics they use seem...off. It's almost like they're bullying people who they don't like or disagree with. In this case, it seems like the guy and his lawyer are really just messing around and being dishonest, and it's a situation that Tesla can gain the upper hand on.

But.

What happens in 5 years when Tesla is 10x bigger than it is now, and doesn't do things so perfectly or well at scale? I really wonder if this type of almost-militant napalm style PR will be handled so deftly. What happens when they get it wrong? I think there's sufficient evidence that they already kind of blew it with the journalist they went after previously, and it just seems like no good will come from this culture over time.

So I'm conflicted. I love their products. I'm rooting for the company, but I do hate these kinds of whiny posts. Tesla is better than this, I hope.
YouTube is one of the best mediums for promotion. Go on a related video, such as "How to build websites", and link your Udemy course in the comments section. Chances are, at least a few people from each video that you post under will check it out. Good luck!
Show HN: How You Should Invest
I'm not sure what you're implying. Is the car manufacturer not allowed to give their side of the story publicly when a lemon law claim is filed against them?
1) That's good to hear about unlimited history - however that wasn't the issue in my case - the files either didn't show up in in the history anymore, even though it clearly wasn't past the grace period, or the showed up and reported an error when trying to open them. So the last I checked, there were non recoverable states in Dropbox and I therefore would never trust it as the only backup (and neither should you).

2) The CPU hog thing is very inconsistent - it probably doesn't affect all OS version/hardware combinations or they would have solved it since long ago. All I know is that I regularly see the client go to 80-100% usage of one core for a rather long time, meanwhile taking forever to sync just a few files - which clearly shouldn't happen in an application that mostly does IO. There are probably certain file types it has some problems with, but I didn't have the patience to analyze it yet, I simply switched to SpiderOak.

So no, I just can't trust their code quality.
How we fixed the Heartbleed bug
This is like saying someone would rather read a 7ft printed document than a 10 page document with normal 8.5 by 11 pages.
Canadian Dentist Plans to Raise Cloned John Lennon as His Son
You can use C on microcontrollers though, and go is not a good replacement there.
Exactly my thought. I'm a creature of stubborn habit. I still browse when waiting for things or bored.

I'm just glad to see that a lot of GNAA and other crap has largely stopped.

Still see the Golden Girls spam posts, but, out of all the possible crap you could be clogging the internet up with, the Golden Girls aren't a bad way to go.
Oh, what an epic failure. Messaging is plainly said the only reason I'm still using Facebook.
If you get really good at a specific product, there is usually someone out there that needs some help. For example Checkpoint firewall, or another IT Security product...
Could you elaborate on what is wowing you? I'm not sure what is so wowing about the tech putting some tape over the fuse. I'm curious what about that has you so interested. Your one word comment didn't really explain it.

Edit: sorry my question offended so many people. I was just curious and did not want to assume the meaning of the "wow" since others seem to be put off by how much logging the car does. I wasn't sure what the parent comment was about. sorry.
Instant, typo-tolerant search in your Linkedin contacts
Just because I feel this response is not the right response does not mean I am suggesting they shouldn't respond at all. But some of the points they make and the way it is framed look pretty bad to me.

I understand they feel defensive and unfairly attacked but there are better ways to handle things.

Edit: I will add that when I worked for an insurance company, some of the letters I had to write had to be reviewed by the legal department. So I have firsthand experience with writing PC pieces that need to stand up in a court of law, notify the customer of important info, admit no wrong-doing, etc. This is not just someone talking out their butt.
This bug is on 70% of systems and ANYONE can run a python script and pull out plaintext Paypal or bank passwords. It is the worst Internet bug perhaps ever.
OK, that's fixed. Do check it out http://cloud306.com/
Thanks!
Yea, it works, in the sense that the bulk of world finance "worked" running on COBOL for 30 years.
I wonder whether there is any meaningful difference between the effort it would take to implement TACK securely in a way that doesn't involve paying what amounts to protection money, and the effort required to use a blockchain-based solution.

It wouldn't surprise me in the slightest if the blockchain-solution were actually simpler to implement and deploy. Fetching public key fingerprints involves a single HTTP request that returns some JSON. That's about it.
Here is the source for the cloud306 agent -
https://github.com/Cloud306
How Heartbleed Works: The Code Behind the Internet's Security Nightmare
Correct, they cannot give but they can sign a new key for your domain which the attacker can use.
I don't know if this comes off as whiny to me, but I get what you're saying. There is a sort of defensiveness to posts like this. They do have something to prove, after all, though it easily come across as having a chip on the shoulder. It also reminds me of interaction of software companies with customers. Sometimes, engineers get fixated on measurable things that they failed to see things that are not measured. Customer satisfaction is not easily captured by metrics.

I think it is fine the way it is now, and watch for when Tesla gets a lot bigger.
I've been running telecom applications on Mono since 2008, doing up to a billion transactions a week across dozens of servers. After sorting out some minor deployment issues (mainly reading docs or making sure we understood which switches do what)... it just works. We've not had any unstable or unpredictable behavior. Once we've tested and gotten it working, it has stayed working.

Only thing we've had problems with I think was the LLVM backend; IIRC some of our F# code didn't work on it. But that was before Mono 3.0 and I am not sure if we checked it since.

One set of applications is typical business message processing. Read XML files, deal with SQL Server, Postgres, RabbitMQ. Another one was using the Mono runtime embedded in FreeSWITCH to do stuff to an active SIP call. FreeSWITCH's Mono integration isn't totally unused and I've yet to hear of any stability related bugs.
I don't see how its possible that manual error checking leads to less code than try/catch/finally. Can you give some examples?

Even if this were true, it certainly doesn't lead to clearer code as you have your error handling code weaved into the mainline of the algorithm. Extracting error handling to the outskirts of the algorithm is a win, even if it costs a few extra lines of code.
I agree. I saw the Heartbleed page while surfing HN, clicked through, saw something long with no TL;DR in red: THIS IS THE WORST SECURITY BUG IN MANY YEARS, AND YOUR SERVER IS VERY LIKELY AFFECTED, and ignored it for a couple of hours until I started seeing more and more posts about it.
Not even sure where to begin with that. You can't simultaneously say we can't trust their certs because they charge to revoke, and say they should be obligated to charge money.

Whether or not their users follow good security practices is not something they can account for. The only way they could account for it would be to force revocation of all previous certificates. The same is true of every other CA. It's incredibly likely that many users of SSL across the board will fail to replace and revoke old certs, regardless of what CA they use.

I agree that there are flaws in the way we currently utilize SSL. But that is a fully separate issue, and not related to "Should StartSSL specifically be considered untrusted". StartSSL shouldn't be singled out to have their business destroyed because the industry as a whole needs to be improved.
"The biggest security problem on the Internet isn't protocols; it's browser UX."

I think it is security UX in general. Anything around certificate issuance/life cycle (SMIME or PGP signed/encrypted mail), PGP key exchanges, etc. That problem has not been solved.
Slashdot beta, a new redesign, is causing quite a stir these days amongst the vocal majority.
"What makes the CA-issued certificates trustworthy is that they are in fact verified" ahahaha good one.

You should read about the history of Certstar, the Comodo RA. Why take money, expand ressources to verify the informations and issue the certificate when you can shortcut the verifications...

No matter how you look at it, the CA system is full of perverse incentives...
I'm in the same boat: 30-plus... bleeding edge tech in an industry dying to be disrupted...high capital requirements. Unlike the author (yet to be named), I've been working on being a good programmer -- first -- so that I can provide an adequate proof of concept and then seek a CTO as well as an industry cofounder. I guess I've been doing it backwards (?)...except, what was it that he built?
Why? My phone tends to be warm because of body heat most of the time. Yeah, the shell can sometimes get warm under load, but that’s the exception. I would guess that if not for body heat and with the right placement a temperature sensor could get useful data.

However, with the phone nearly always being transported so close to the body I really don’t see it being useful.
Why not link to the source article? http://9to5mac.com/2014/04/09/jony-ive-shakes-up-apples-soft...
That's basically what I'm thinking. The demographic is becoming more and more Indian, which drives away Westerners, who are the people Quora can make money on.
How We Raised $450K On Kickstarter | Moment
Surveillance is the Business Model of the Internet: Bruce Schneier
Yes. And assume there will be bugs.
It;s 404 at the moment, looks like for awhile as there is no goog result nor subsequent cache to view...
http://slashcode.com/www.slashcode.com/sites.shtml

I believe the other site(s) would include the ruinator's other Taco acquisitions Sourceforge & Freecode. I could be wrong and often am.
The article makes a generalization that is not correct in most cases around certificate request and issuance --

"And fundamentally you have to trust that they who hold the Queens aren’t dishing out copies of your certificates."

The entity holding the Queens can give out a copy of your certificate, sure, but in most cases, they do not hold the crown jewels -- your private key -- which is the part of the Heartbleed bug that is really bad.

There have been cases of CAs either issuing or being compromised and issuing new certs which duplicate a site identity, but that is different then releasing the private key of a particular certificate.
I wonder how this can have worked; according to my understanding VLF transmission for underwater reception needs very much power.

Did they bring really a powerful generator in the plane?
In this case, the lawyer is going to try to smear Tesla, hoping that they'll settle quickly to get him to shut up. Which more or less is extortion.

This is Tesla sending a message to all lemon law lawyers that they do not negotiate with terrorists. Seems fair to me.
After using it for a few minutes, what I can already tell I would love is more control over whatever CSS is being used to style these presentations. Any guidance available for that? For example, I like the headings on theme used to demonstrate the big headings, but don't like the monospace font for the content on that theme.