skysight-inc/HackerNews huggingface dataset:
Opposite of fixed is `not fixed` instead of unlimited. I never said America has unlimited jobs but the number of jobs would depend on too many factors.

Someone has a degree does not mean the person is productive enough to get an actual full time job. Also government's protectionist mechanisms only hurt these people. Assume that for any job there is a productivity level required X. For some value X=N, it is profitable to simply outsource that job to India. For all values X>N it is affordable to hire a person in US, also there is a strong demand for people X>N.

Under these conditions all the American citizens who have a degree but with productivity level <=N they have no choice but to to something to raise it to a certain extent in order to get employed or learn to make Tacos.

If the government comes up with more rationalized H1B limit then many companies would prefer to simply give H1Bs to cheap labor from India. Yes, true thousands of half educated people from India would flock to America, but at the same time this will lead to more x<N jobs in US for which even Americans can compete. A lot of those unemployed graduates would then have a better shot at getting employed.
I probably wouldn't try to subsist on this, I like real food too much. But at the same time, I think you're kind of overemphasizing the danger. Humans manage to survive just fine on a widely varying array of diets. And compared to the crap I eat much of the time, this can't be all that bad.
Beyond being seldom used, they also leak usage information.
I'm tired of your elephantsplaining.
I'm not exactly disagreeing with you here. I just dont understand how that is different from obscuring your attack surface making you less likely to be targeted by some sort of mass generic attack vector.

Nobody argues security through obscurity doesn't work in some form, we argue that it doesn't make you secure as a matter of fact. Much like using some obscure SSL implementation. It sure does have the net effect of making you less likely to fall victim but that isn't security that is obscurity.
I use(d) free StartSSL for my hobby projects too. So I wanted to revoke my certificates today, post heartbleed and stuff.

They charge $25 to do the right thing and revoke your cert. So I will not use them again.

Edit: Btw. That's per fucking subdomain, as you don't get wildcard certs for free.

Going back to self signed I guess...
I do not want my customers' security to be based on "enthusiasm," and I can't see any way you could get something with more resources put into it than SSL in a near-future time frame.
The Importance of Retail Store Signage
In order to attack an HTTPS connection, the attacker has to have MITM position against the victim: the ability to intercept TCP connections.

Such an attacker can obviously also block the CRL/OCSP lookup if one is made. Even with revocation checking enabled, no browser that I know of will fail a TLS handshake if the revocation check is blocked.

(You can configure Firefox to do this. Tools -> Options -> Advanced -> Encryption -> Validation, check the box for "When an OCSP server connection fails, treat the certificate as invalid" - so says https://wiki.mozilla.org/CA:OCSP-HardFail)

I claim that soft-fail revocation checking is basically nonsense. That's the point that I'm making in https://www.imperialviolet.org/2012/02/05/crlsets.html.

Making it hard-fail isn't viable: it makes OCSP servers a single point of failure for huge parts of the web. That's why Chrome has a CRLSet system that actually can achieve real goals. The attacker has to persistently MITM the client in order to block the CRLSet update.

The CRLSet is limited in size. I had hoped that CAs would use the reason code mechanism in CRLs to remove the "administrative" revocations that dominate their CRLs. (Those are revocations where there's no suggestion of compromise.) Some do, but most don't.

It's not true that the CRLSet doesn't include any Comodo or Symantec (who now own Verisign's old CA business) CRLs. In fact, Symantec/Verisign CRLs are the biggest contributor to the CRLSet.

But it's true that the CRLSet is limited in size. We focus on CRLs for CA and EV certificates. I don't think the world has a great answer to the revocation problem when certificates are valid longer and longer periods.
Which companies in the U.S. offer an internship to non-U.S citizen CS students?
I am neither a U.S. citizen nor the student of any U.S. university. I wonder, which companies in the U.S. have an internship position for Computer Science/Engineering students who are from outside of the U.S.?
An IPO provides liquidity for the stockholders. That's almost always the reason for an IPO when the company doesn't need the cash.
Plus getting distribution will be cutthroat savagery. Direct-to-consumer is a huge amount of work and limits growth. Costco, Whole Foods, Trader Joes and Amazon should be hit up at the same time.
MakeHuman 1.0.0 released
Off with his head!!
The company is taking essentially an open-source approach, and is deliberately fostering an active DIY community. Ensure and other products don't operate that way, as far as I know. That's pretty compelling to a lot of people.
Apple has deprecated OpenSSL as of Mac OS X 10.7 and they are not including it with iOS. Instead they provide their own APis.

The semi-official reason though is that OpenSSL doesn’t offer API compatibility between versions.
I thought the implicit comparison was more to WhatsApp, which also directly charges users (SnapChat is, despite the name, not really a "chat" app).
I'm upvoting this for the quote they added at the bottom. Brendan Eich was completely silent about his donation, so people made up their own minds about his current views. This is fundamentally different since Sam Yagan expanded on why he donated and what his current views are.
A look inside Unreal Engine 4
Part II - http://www.gamefromscratch.com/post/2014/04/08/A-look-inside...
I never realized RC4 was leaked onto Usenet and a mailing list anonymously: http://web.archive.org/web/20080404222417/http://cypherpunks...

It's interesting to read the very first reactions and evaluations: http://web.archive.org/web/20070423042054/http://cypherpunks...
>Diet is still not well understood, and current science, IMO, is too soft of a foundation upon which to build a complete meal replacement on

Well, the thing is that there are all sorts of micronutrients and less "quantified" benefits that are derived from eating whole foods. A product like Soylent will cover the primary nutrients well, but will likely miss the mark with regard to truly replicating how we are supposed to eat.

But, here's the thing: given our lifestyles, costs, and industrialized system of processed food production, so few people eat a consistent diet of chemical-free, healthy whole foods. Just drinking Soylent to avoid the chemicals in our current food supply alone may be sufficient to improve one's diet.

TLDR; relative to the crap that comprises most diets, Soylent will likely (and sadly) be better for the majority.
StoreDot's Big Promise – Fully Recharge Your Phone In 30 Seconds
Very cool and super timely, implementing partner offers and was kind of upset about the ugliness resulting from their links.
You only hear about the people who succeeded when everyone told them they would fail. The many that failed when everyone said they'd fail don't often make the news.

People usually have good reasons why they say negative things. It's worth understanding the negative sentiment.

For example, victims of certain types of fraud are often warned repeatedly by friends and family that they are going to be defrauded. Some still go ahead and lose staggering sums of money.

It's important to really listen to the naysayers, if only to understand the risks. Then you can make an informed choice as to if you'll try your hand at something that's potentially costly.
Soylent and Bitcoin are the two things that I am quite positive will be a remarkably large part of our future.

The biggest feedback I get about Soylent are the following:

- What if it doesn't taste good?

- But I enjoy eating real food...

We'll find out soon about the first and, frankly, the latter simply doesn't apply to a very large number of people. Soylent is perfect for people who are short of one of two quite valuable things: time and money.

Time: When's the last time you thought or heard "man, I wish the day had 10 more hours in it"? Soylent won't buy you 10, but I'd say it'll easily buy you one at the very least. All of a sudden you don't even have to think about grocery shopping or where you're going to go on your lunch break. You now get to spend your grocery evening doing whatever you want because you have Soylent. You can spend your lunch break working and get 45 minutes more done every day, or doing something you really enjoy.

Money: Given all the recent posts about what percentage of people own what percentage of money, it's clear that there are a large number of people who are not well off. There are people in third world countries who are not and will never be well off. Soylent will probably be able to feed them the most nutritious meal they've had in a long time for very cheap. They're at about $3 per meal right now and I'd imagine the majority of their focus has been on scaling infrastructure, not pushing the price point. Imagine when the get into manufacturing ingredients themselves, the price point could be much lower. That would be revolutionary if we could feed entire countries more nutritious meals for far less money.

I can't wait until I get my Soylent. Hopefully it tastes as great as they advertise. :P
Would it be feasible to make OCSP errors abort the TLS connection if it only applied to sites that have requested HSTS?
As far as I can tell, Moore's Law ended about 10 years ago, because 3 GHz CPUs were available then and most CPUs are slower than that now. Sure transistor counts have gone up, but the amount of computation that can be done in a single thread hasn't seen the 100x speedup that it did in previous decades. Mostly there's only been cheating by adding pipeline stages or ram latencies to get the frequencies up.

Also just before I graduated college in 1999 I remember my VLSI professors talking about how chips had passed the point where the interconnect had a square cross section and were moving to rectangular. So today chips look like skyscrapers, with tall ribbons of interconnect that suffer from crosstalk.

On top of that, there's been failure to move to distributed and multicore processing outside of GPUs, or for FPGAs to get adopted by the mainstream. I've given up on innovation on the hardware front from the big players, but I'm optimistic that approaches like Google's Go running inside hypervisors on diverse hardware is going to bring the high throughput we see in gaming and DSP to the mainstream. I’m unimpressed by OpenCL and CUDA and won’t really consider parallel computation as having arrived until more readable languages like Python and MATLAB generate accelerated code for us.

I realize there are holes in my statements here that one could fly a 747 through, but when the single fastest increase in my computing in a decade came from installing a 512 GB SSD drive, it means that something went terribly wrong. Moore’s Law ending could have more to do with computers reaching a point of being “good enough”, essentially becoming disposable appliances, than limitations with technology or cleverness. So they may not be getting any faster, but they are becoming so cheap that I think we’ll see life change in rather interesting ways in coming years.
I think his statement strongly implied that he was speaking about session ids of site he doesn't own. If you own the site, saying that "using the session ids would be illegal" is a stretch, at least without qualifiers. So, pretty sure he was talking about other people's sites.
For a moment I thought this was a way to workaround any patents with this hack, by rediscovering the hack dynamically; but I could be remembering a different patented technique.
Calling H1Bs slave is a big insult to the black community. If H1B was slavery thousands of people would not have willingly applied for it.

H1B has lot of restrictions most idiotic being that the spouce has to sit idle. That is idiotic.
I don't eat meat as I don't agree with either how it's produced or the suffering necessary to extract it.

Right now, I mostly consume quick oats and protein powder for bulk caloric needs. Vitamins are a generally a waste of money so daily requirements are met by a balance of vegetables, nuts and legumes.

If Soylent were viable and cheaper than Ensure, I'd consider it. But I'm unwilling to pay more for convenience as I can do better on my own for far cheaper.
Do you mean nobody on the CA side or the end user side?
CA's suspend certificates all the time - instant e the scam site had theirs pulled a few weeks ago...
I'm not suggesting sharding it, I'm suggesting that almost everything in the sim can be set up in an embarrassingly parallel way, take advantage of 4/12/whatever cores, and lower the amount of slowdown.
Study Links Video Gamers’ Aggression with Frustration, Not Violence
I had a program for my HP-48GX that use to do something similar. It was especially useful when I knew that my decimal answer had some numerical constant, such as sqrt(2), and I wanted to convert it to something more reasonable. It would only return a single value, so I had to be careful that I didn't just use it every time, since just because an answer could approximate a multiple of Pi, it might only be a coincidence and not a good answer.
I agree with you. At least I think I do, where you are talking about the fact that higher pay equals better retention and thus lower long-term costs to employer.

Although I imagine since this is a sort of proposal or question as to "how do we change the status quo" where those companies with the best track record are in fact the leaders in their respective markets. In that other world I imagine pay would be better at these companies since they would be market leaders.

And I'm not even necessarily saying, though it may not be obvious in the original question, that people should need to chose between "GreenPeace" and "British Petroleum". I'm instead imagining, for example, that someone would be chosing perhaps between "Facebook" and "green Facebook" whatever that other company's name is.

We're still in a demand / supply economy so companies that do the same sort of thing would need to start differentiating themselves not just in how large and powerful they are, but also in how they impact the world in a larger way.

One idea here would be: Suppose a large pharmaceutical companies are trying to patent technologies to protect their businesses, but then a new kind of pharmaceutical company came into existence where they openly worked more for the greater good, not trying to patent things but trying to solve important health related problems and making those solutions open. Because people see the inherent good in what they're doing all of a sudden they are the ones who become the market leader in pharmaceutical companies because everyone wants to be their customers instead of those companies who try to stifle innovation through ridiculous patents and even more ridiculous marketing strategies.
Maybe he is saying by removing trusted root certificates he will trade the possibility of receiving a fraudulent certificate the first time he uses a site for the possibility of not being warned if a certificate changes because the trusted roots are compromised. If he needs to worry about state actors there is an argument to be made for this trade-off, but really if he was worried about that he would be delivering certificates out of band and not visiting any unknown websites on the machine he needed that level of security on. (Maybe justifiable against mass surveillance where you're a general target rather than a specific one).
I use Thunderbird as both my mail and news client. It has a threaded view and adequate filter/killfile capability (though not as sophisticated as some other newsreaders that use a score based system).
Apparently Akamai was also given early notice, from the OpenSSL team.

https://blogs.akamai.com/2014/04/heartbleed-faq-akamai-syste...

I wonder why the various linux distros like debian could not have been notified simultaneously.
I imagine Airbnb units will raise prices as well, as happened when I tried to book Airbnb in New Orleans without realizing it was Mardi Gras.
First of all, management shouldn't be estimating how long it should take you to do something, they should be asking you for estimates. I don't have productive advice on how to deal with this other than suggesting this to management and maybe looking for other work if they disagree.

Second, your estimates will still be wrong (almost always on the underestimating side) and sometimes wildly so, thanks to Hofstadter's Law (It always takes longer than you expect, even when you take into account Hofstadter's Law, see: http://en.wikipedia.org/wiki/Hofstadter's_law).

Third, you will get better at estimating the time of your own tasks with time and lots of experience, but you still have to accept that estimation when it comes to software is more of a black art than a science.
As opposed to all other companies that are started by toddlers?
How to Read "Pearls of Functional Algorithm Design"
Going to take a wild guess that this is "Begin, A Tactical Starship Simulation"

http://en.wikipedia.org/wiki/Begin_%28video_game%29
First of all, thanks for the reply. I wasn't trying to imply that Chrome/Firefox we're wrong in not checking. I understand your points against it; I'm just saying that if people revoke their old certificates today (because they might've been compromised) someone can still MITM pretend to be any of those websites if they actually got the key. Lower scope but still a problem, especially if your cert lasts for 3+ years.

I was using crlset-tools to test the list against an intermediate Comodo CA and the intermediate/anchor certs for Versign and it didn't return any results. I did the same thing for DigiCert and it did return some, so I assumed what I was doing was correct.
Chrome thinks this site is unsafe, which amuses me at least.
Yes, if you use a self signed cert and out-of-band verification, then yes it would probably be more trustworthy than a third-party verified cert (like a CA).

I don't think that is what the parent was saying, however, in saying he would trust a self-signed cert. I don't think he meant "Call up the website host and ask for them to verify their public key"
Is this on their hosting or DNS offerings?

Given that Gandi's reputation is outstanding, your experience seems quite odd. Can you elaborate?
"The only way to get that level of assurance would be to build an automated verification suite, or similar."

Wait.....what? OpenSSL doesn't have an automated verification suite? What the?

Well there you go. That's step #1.

I completely disagree with others' calls for a rewrite, and I really don't like their attacks on OpenSSL developers (not that I know them or even know who they are.) How many of you have written software that has been tested as thoroughly in the real world as OpenSSL? Some, but not very many, I presume. OpenSSL has an installed base of billions and billions of machines, and it is mostly successful, and any software that sees that much use (and the corresponding scrutiny) is going to have vulnerabilities revealed. We should absolutely not, not, not rewrite the software and open ourselves up to whole new bugs, or worse, bugs that were in OpenSSL and patched years ago. It would be fine to start a new piece of software, with the hope of competing for SSL, but a widespread
campaign to replace OpenSSL would be foolish.

The only possible caveat to this would be if it was developed more like clean room software a la NASA's probe/shuttle software, with every change agreed upon by a large committee of people, and no change made without weeks of planning. If it was replaced by a process so rigorous that it would not admit any bugs the new software might have a chance of competing with OpenSSL. And even then, a committee can't think of everything.

Everyone is starting from the reference point of perfect security and yet perfect security is impossible. Literally the best you can do is to have software that has been subjected to attacks over and over and over again and though it may have been flawed it has also been patched.
I'm guilty of frequently recommending this book. I think it's wonderful, but I also rarely am clear about it being something of a challenge to get through. This post reflects both on that challenge and the underlying "decoder key" for beginning to scrape meaning out of the book.

So now I will highly recommend reading this post and then reading Pearls of Functional Algorithm Design.
why should I care what this one author says? The academic consensus it that there is a gender pay gap.
Worthless except when your cert key is stolen and you want to revoke the old one?
I believe that eternal-september.org provides free access to newsgroups. As for the communities, it really depends on the newsgroup. Some of them are still relatively active.
Ask HN: How is our incident response to the Heartbleed Bug?
I'm especially interested in things we should be doing but aren't.

For some additional technical details specifically related to OpenVPN, and VPN services in general, see http://thread.gmane.org/gmane.network.openvpn.user/34706/focus=34712

Thank you for reading.
The response to a subtle weakness in cryptographic software should not be to reimplement the cryptographic implementation from scratch. This inevitably introduces far more problems than it solves.
They don't really spend 0% on sales. They just don't have a traditional salesforce. They put a huge amount of resources and effort into pre-sales support (which is arguably sales with customer aligned incentives) and customer funnel progression.

It is a small but important distinction, what they don't do is scale sales by throwing salaries + commissions at a highly paid sales force.
The page doesn't seem to say what this actually is
This was a “beach project” from a Hawaii trip last fall
Is Hackerone the thing now for reward programs?
That's only true if you're not verifying the identify of the presented cert - how do you suppose client/server certificates work? For example, along the lines of what every VPN system in the world uses? VeriSign isn't involved in the transaction between my company laptops and the ASA in my datacenter.

Besides, having the third party CA signature in this day and age doesn't tell me much other than the person presenting the cert coughed up whatever protection money the particular face of the PKI protection racket demands, and ostensibly the CA did some level of verification (could be more, could be less, I honestly do not know or have time to find out) as to the "identity" of the person who's info is on the CSR.

Really, for your own uses, you're better off self signing with your own CA, noting down the identifying information of the cert at generation time, and then installing that cert as trusted either ahead of time, or hitting it from the third party and double checking the information matches up.
I'm sorry, but what? This is robot design 101. How could you not have included this in your initial prototype?
The largest Australian bank (commbank) was reporting as vulnerable on filippo.io/Heartbleed/ for some hours after the vulnerability became known. GE Money Australia haven't fixed their vulnerability yet either.
I don't think this is a response to a recently-disclosed weakness in OpenSSL. The project has been active for almost four years.

Minor edit: almost four years
TOFU: don't most browsers tell you if you've been to the site before, and whether the cert has changed since your last visit? I seem to recall that at one time Firefox could be configured to not even complain when it saw a self-signed cert it recognized?
No, he hasn't. In fact he made a point of refusing to do so.
This inevitably introduces far more problems than it solves.

Could you elaborate more on this? I fail to see how this is inevitable.
Yes, it's entirely legal.