skysight-inc/HackerNews huggingface dataset:
Maybe. That's what most people use GiftsOnTime (our biggest competitor) for, actually.
This does not inspire confidence in akamai for me. These days people on the internet seem to get super excited when various companies write post mortems on how they screwed up. Yay, they screwed up and were honest about it!!! I find those to be wildly overrated. I'd rather there no be a screw-up to begin with. And I don't particularly care if you come clean or not.

I know bugs are written and bugs happen. It's an unfortunate fact of life. And anyone who posts their code will likely have holes poked in it by the community. But the akamai thing really sets of warning flags. The fact they thought it would work and it doesn't, at all, does not sit right.
No, that goes too far the other way. If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too?

Your argument is totally correct if I am simply unsure---if I don't know whether an exploit affects me but I suspect it might, I assume the worst and act accordingly. But in this case Akamai had good reason to believe they were unaffected. (And, when someone demonstrated otherwise, they responded responsibly.)
Having spend the last week or so working with client certificates, they could be so much more if browsers implemented a proper interface for managing them, or at least a much more intuitive one than they do at the moment. They work spectacularly for building closed APIs where you control both sides, however. They're just a bit tricky for the end user most of the time
Heh. This is exactly what Google was doing with the StreetView vans, and a bunch of home users with open WiFi networks are successfully suing them for collecting their packets.
I just want to say I don't think you deserve to get voted down (as you currently have been). I was thinking the same thing about this story - it's very interesting because it highlights the (utilitarian) philosophical battle around Open Source. It's really not totally clear in which case they were safer. Your position should at least be considered.
> your software is a bad citizen in the windows ecosystem

According to MS who seem to be trying to force the idea that all software needs to be "installed" and have an overly complex installer/uninstaller. I care more about the flexibility and convenience for my users than what MS thinks (which is ultimately heading towards locking users in a walled garden, so no surprise that "just download and run a self-contained executable anywhere" is perceived as somewhat of a threat.)

> And you get the benefit of being able to easy throw it out via GPO, pull dependencies like VCRT versions etc.

Those are not needed for what I'm doing, so they're not benefits to me. But I guess if your idea of "pretty small" is 400k, then that's not really a concern...
My friend started a site that does exactly that: Goodst.org
They believed that they were covered and that no compromise could/did occur. It's a mistake they now acknowledge but they have owned up to it and are taking action - just as you suggest.

I believe their actions are honest and completely reasonable. If they had known they still had an issue I seriously doubt they would have publicised the patch and risk the issue they now have.
Hard to do effectively until we have consumer FMRI hardware that can measure dopamine/serotonin release.
I see these mechanisms are broken — but why?

Broadcasting a signed blacklist shouldn't be that hard, given both a wide variety of sites that all want the latest version to be available, and the example of peer-to-peer networks. Also, 'Google Safe Browsing' reliably, and in a semi-privacy-protecting manner, informs multiple browsers of a blacklist of scam/malware sites.

I can see the problem has some tricky parts to it... but it doesn't seem any parts are thorny, intractable problems.

Have CAs prepare a digest (maybe bloom filter?) of revocations regularly. Sign the hash of this digest, and make the digest available via many redundant paths (mirrors, CDNs, P2P networks). Interested servers – perhaps every server reliant on a certain CA – gossip via headers (or even DNS) about the latest and greatest CRL versions they've seen.

Then browsers can be reasonably sure they've got the latest, or that it's somehow being kept from them (gossip from third parties says there's a signed later one, but all usual sources are unreachable) – without an extra, slow, privacy-compromising poll every new TLS session.

Pirates have no problem flooding the world with fresh media files, against active legally-privileged interdiction efforts, with each such file much larger than all revocations ever. Why can't certificate/TLS professionals and "cyber infrastructure authorities" match that?
Carl Karsten (http://www.linkedin.com/in/carlfkarsten) owns NextDayVideo, and is pretty synonymous with PyCon video.
Yes, Florida (which gets massive amounts of rain) has them absolutely everywhere, from regular roads and avenues, to highways and turnpikes. They're the plastic version, not the metal snow plow survivable version. There's almost never snow down there anyway. Driving at night is amazing. The downside is that the roads are so nice people get a little too comfortable and relaxed when driving. So there's massive amounts of accidents and pedestrian hits and fatalities.
Sid Meier's Civilization: Beyond Earth Is Coming To Linux
The real reason is because Shai Agassi, a 0.001 percentile guy, was beaten by Elon Musk, a 0.0000001 percentile guy.
There's already debate over the merits of introducing this in the Utah public schools. I think it's a great idea.
And enterprise software development has been going in the opposite direction. I work for a $100 billion company. Some days, I want to stab myself and throw myself out the window.
Offtopic: My cat opened the TC7200 accidentaly. There are two serial ports. One is easily reachable and gives access to the bootloader which lets you r/w memory (and jump to anything in memory).
The second one is under the cooler. 
You
 Your cat can easily solder 
yourself
 itself on it from the back of the pcb, if 
you
 your cat doesn't want to remove it. You'll see linux booting, you can login with your webinterface credentials, but it kicks you out immediately because you don't have a shell.

Just in case anyone want's to work on what my cat has discovered. It is leased with my ISP contract, so I would never open it myself.
Wow. That's actually something that hadn't really struck me until reading this comment. While there is development to be done in ever project still, the upfront amount is growing smaller and smaller with the (P|I|S)aaS techs available to companies. A lot of it does really come down to making the front end of a product.
If the tone of my message was a bit harsh, it was mostly to reflect his, and thankfully I do not have a life boring enough that this is "my moment".

Still, I stand by my point of view that at the time of writing, akamai's POC was presented neither as an absolute final fix nor as their own production version of it, and judging it as such was misplaced.

That akamai realized the flaws he noted in their patch also applies to the real world code doesn't change that.

I never said the flaws he pointed were not real flaws nor unimportant ones, I merely disliked the ridiculous and unjustified tone he used to to destroy a proposal and used the same against him.
This Free App Will Verify If Your Android Phone Is Vulnerable To The Heartbleed
I think it's more about the possibility of guarantees.

OpenBSD has un-typed IO. Typed IO gives you guarantees that un-typed IO can never give you. For starters, a number that doesn't validate properly as an Int, for instance, will simply not be able to pass through, potentially stopping if not Heartbleed then bugs like Heartbleed.

Don't you think companies and other interests would like stronger guarantees, especially when they're running applications that protect information that hackers and foreign governments and other companies would love to see?
I have some ideas for improving the efficacy of online voting systems, but starting a new online community is hard. Even just starting a subreddits is hard, and I imagine that to be lower-friction than creating a stand-alone site, given Reddit's large existing user base.

If you have an online-community that you run and would like some ideas to combat vote-based-on-agreement, here are a few that I've thought up or come across:

(Not claiming that these strategies are ungameable).

* Limit the number of upvotes a user can give per day, thus making votes more valuable.

* Force users to space-out voting, allowing only 1 upvote every 5 minutes.

* Vote value: Votes are valued more the less you do it over a certain period - so if you only upvote once per-day, that post gets more points than if you upvoted everything in /new. Choice: Do it hidden on the backend, or could be interesting; do it in a user-configurable format. Give users, say, 100 points per-day and are allowed to upvote transparently - you can give one thing 100 points or four things 25 points.

* Time-delayed voting: votes are only allowed after a certain amount of time has passed since you clicked on a link. A well thought-out and reasoned article should take at least a couple of minutes to read, so I can upvote that after I read; I'm not likely to wait around to upvote an image-macro with fewer than a dozen words unless it's really special.

* Karma cap, both negative and positive: Limit max positive karma to something low, say 50. That's high enough to see that a user isn't brand new but isn't trivially attainable. That way, it's fine to get to the cap, but posting inane one-liners attempting to reap thousands of points for a single comment isn't so tempting. Limit negative karma to something lower, like -100 to dissuade trolls, while still showing that a user is disagreed with. Hopefully that encourages discussion for the sake of discussion.

* Meta-voting: You vote on how many points a post got, so if a pithy but well-timed comment that says "lol butts" gets a lot of points, you can vote to say that the post didn't deserve those points. Make this a limited power granted to a select (but changing) group.

* Make downvoting cost karma: If it cost karma to downvote, that could be a higher bar to drive-by-disagreeing.

* Not sure if it's a good idea, but turn the script around. Instead of trying to avoiding the Pepsi-Blue Advertising syndrome, charge money for votes transparently adding points to a post or comment. As users can still downvote items, it becomes expensive to elevate a bad piece of advertising. Maybe extend this to users by allowing users to receive money for lots of highly-rated comments. Or perhaps use Dogecoin as your currency of choice as the real-world value of 1 Doge is so low that it's effectively free in small quantities, but not actually free.

I don't think allowing the masses to vote on things is a bad idea, but it's an idea that needs some refinements for best effect.
I love Scratch and teach it in my gen ed class, but I'm not sure I'd quite call it a "general purpose tool" in the same way that Hypercard was. I could certainly see it evolving (or rather, forking) into such a thing, but as it stands it's a little too kid-education-animation-game-oriented.
Someone please fix 3d software. Autodesk owns 3 of the top 4 3d software programs. They are about to stop developing Softimage. There other two have little innovation and lots of bugs. Their biggest competition Modo is not a complete enough package to be used by major studios. Someone please bring a fresh pair of eyes and create an innovative killer 3d program.
#Love: Thanks, Porn
As someone very interested in Soviet Union, it's system, this is a great resource. I'd love it if this was available on kindle or a paperback.

Even Russians will say Soviet Union is shit or people will react like, 'why are you learning russian and so obsessed with Soviet Union', I think it's because I think it could've been a great system, it's a noble ideology that men and women of all races are integrated and all receive the similar dividends but human greed and corruption always ruins things. I don't like the way people have been persecuted because of Soviet Union, but I find it's technologies and philosophies very interesting.
microsoft removed it, but that doesn't mean he was right.

Last I checked, the internet did not end while XP had raw sockets, and windows server retains this capability.
> If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too?

If you have a memory read out of a process that contains sensitive data, you should always assume that the sensitive data was breached, even if you "programmed defensively against it". Period. No exceptions.

They had good reason to believe they were unaffected, which is why they shouldn't have hit the "oh shit, the world is ending" button. But the decision to not roll their keys in the face of a breach was a massively irresponsible one. We have how many years of major bugs to look at? And in how many cases are the likes of Akamai (that is, organizations with theoretical mitigations in place) actually safe when they think they are?

Always, always assume your protections are faulty in a way that a motivated attacker will figure out.
In 1920: agriculture was 27% of labor force: http://www.agclassroom.org/gan/timeline/farmers_land.htm

Now, 2-3%. One in 4 people had their profession superseded. A lot of that slack was taken up by industry (and war and death), but that took 20-30 years to catch up.

Is there a pool of work for people to absorb 25% of the present labor force? Most of the emerging technologies I see are labor-saving, not labor consuming.

Two possibilities for big labor demand in the next few decades:
- healthcare and assistance for the elderly
- removing development restrictions in booming cities, unleashing an epic (or Chinese-level) building boom

Both have fundamental political foundations and won't be solved solely by technology.
It's funny how you talk about me without knowing me. You don't even made a background check to see if I adjust to your node.js bias.

No, my company sells hard core technology to big vendors and sign the kind of corporate contracts that you refer in your comment. Since the IRS will not solve the issue there is another route: selling a hotpatch service to another vendor who sells to the IRS.
I've thought about how public chargers are something that businesses should start using. Imagine sitting down at a restaurant and getting a full charge during your meal.

If wireless charging gets more standard, then there won't be an eyesore of cables.
> I believe their actions are honest and completely reasonable. If they had known they still had an issue I seriously doubt they would have publicised the patch and risk the issue they now have.

I completely agree that their actions are honest, and I seriously doubt they would have played things this way if they knew their protections were faulty. I'm not saying that they're acting maliciously; I'm saying that they acted in an arrogant and irresponsible way.

If an attacker can read memory out of a process containing sensitive data, the assumption should always be that they got the keys to the kingdom even if they didn't. I'm not saying they didn't do their best to defend their service -- on the contrary, I think that their defense is a good one -- but that they played chicken with an exploit and ended up on the wrong side of it.

Their customers deserved better.
That's what I'm thinking. Short cable, and rubberize the metal ends so they can't be used for cutting.
Car startups are so hard - more respect for Tesla.
From a legal point of view, the commenters below address some of the issues which obtain under these circumstances. But as a non-employed intern you are not going to be able to engage in substantive negotiations with them about the terms of a non-compete/trade secrets clause. You are not a headhunted executive, your negotiation position is different. There is great asymmetry in power in your negotiation. All you can do is sign, if you want this position. If an issue comes up later--if they even remember you six months after you leave, 18 months from now--deal with it then. Or have your new employer deal with it.

Companies are bending over backwards to claim that interns are not employees when in most cases they very much are, except for the payment of wages. It will be interesting to see how the "work for hire" copyright doctrine applies when on the one hand the intern-employing company says, "these guys just hang around, the school sends them, they're not employees" and on the other, "we are entitled to the code, processes and procedures they came up with during their time here."

There was an article a few months ago posted in HN about why it's worth it to take the risk in signing boilerplate. There are very few exceptions--one current dispute is the Hoefler/Frere Jones partnership dispute; one side maintains that an employment agreement that was signed by one of the partners is dispositive of their relationship.

Ultimately, six or twelve strangers (they call them 'jurors') will be dragged in off the street and asked to give their group opinion on the facts.

Your internship is very unlikely to require the intervention of these strangers, so don't worry. Try to learn everything you can.
At some level to use an OS, Qubes need to be able to talk to each other. We've had hacks which break TCP stacks, OpenSSL (recently) and practically every other type of subsystem.

Hell, Cryptolocker shows up that fundamentally the whole thing is solving the wrong problem in the first place for ordinary users, which is who cares if the OS survives if your data doesn't?
A new way to Manage Your Technology
Blackbox web security SAAS.

There are some services out there that will scan you for vulnerabilities, but I have yet to find a really slick way to integrate security "for free" into your own servers/services.

This would mean at minimum:

1. apt-get install X. Automatically decent kernel/network/firewall configuration occurs, removes cleartext passwords from ssh and changes the port, etc etc. This is just a base starting line.

2. malicious user detector. Probably cooperating with an API within ruby/jvm/python/php/whatever is a mixpanel-like way I can define custom events and possible milestone-firewalls. E.g. this is a new user sign up, here are the relevant fields & ip. Or here's a comment on an image from user X with IP Y. Rather than having to figure out if we're likely being abused outsource that decision to the service & have it help you block the evil-doer.

3. APIs to help with usernames/passwords, setting up TLS & perfect forward secrecy, etc. That is to say, give me patterns I can use that every app has even with some level of customization.

4. Have built in DDOS protection, particularly for resource starvation attacks that might be more app-specific (request X took Y>Z time, and it's being repeated endlessly).

I understand that security is complicated, ideally should have full time staff, every app/service is different, ya yada. Except when you're starting out you don't have these kinds of resources and something like this could get one quite far, not to mention be able to see much of the internet and what's happening across clients (like gmail with spam) and thus have an advantage over you. It seems like a giant hole in the world of app development and most people are terrible at security when it comes down to doing anything more than firewall + ssh keys + bcrypt user passwords.
A Pyramid in the Middle of Nowhere Built To Track the End of the World
I've heard the "low maintenance costs" point made often by Tesla themselves, but based on my research from their website it doesn't hold up. Tesla encourages you to buy their $600 a year service inspections[1], and their $1,000 a year extended service agreement. And God forbid anything breaks outside of the warranty, because you'll be in for some costly repairs[2].

[1] http://www.teslamotors.com/service

[2] http://insideevs.com/dont-wreck-your-tesla-model-s-because-r...
6 Customer Success Secrets
In these situations, I believe there are two types people:

A: "Wow, things are really messed up. I'm out of here."
B: "Wow, things are really messed up. There's opportunity everywhere."

Either can be right, depending on the person and situation.
https://github.com/paulasmuth/fnordmetric
Do you have a reference on that? I'd love to read it
>scripting language

It's just a categorization. Not an insult.
We're not doing anything we wouldn't have done in response to mail to security@akamai.com encrypted to

pub 4096R/5B9283CE 2007-04-04 [expires: 2017-04-01]
Key fingerprint = 4A76 FD9B 3603 C9F5 33F8 1490 49E0 5C45 5B92 83CE
uid Akamai Security Team (General Public) <security@akamai.com>
sub 2048R/DF985919 2013-03-29 [expires: 2015-03-29]
Volvo's inflatable car seat
that is very good insight. Another point might be the idea of creating buffer zone (Ukraine) to counter the threat of NATO military assets being placed right at the border with Russia, access to Black Sea. I understand that if Putin does not take Ukraine, NATO will.

This is like China not willing to give up North Korea, it has it's function as a buffer.
It doesn't cost $1000. What you're paying for is R&D. Just like a Windows 8 DVD doesn't cost hundred of dollars to make
From someone external to all of this, I don't think the US really has a foot to stand on when it comes to telling the rest of the world what to do militarily. The Iraq and Afganistan wars really leave a bad taste in my mouth. Where are those WMDs that the entire war was based on? I still remember seeing Cheney standing in front of the entire world and showing those bullshit pictures to the UN. They invaded a foreign country and killed people based on that bullshit.
How is the isolation in Xen better than Chrome sandboxes - do you mean the attack surface is smaller, the code quality better, or the task somehow inherently simpler/easier?

From where I sit, vulnerabilities in virtualization have seen less public scrutiny than the Chrome sandbox. Eg none of the hypervisor vendors have a bug bounty program, which would be at least some kind of signal.
If this was to catch on, would the NSA (assuming they don't already) throw more resources at building viruses that attack the CPU directly - intercepting any of the instructions sent by the VMs?
You're kidding, but some day, scanning people's brain structure and comparing would probably be pretty effective.
I think it is important to remember when validating flaws, that we show that attacks are possible not they are necessarily demonstrated. Just because one cannot construct an exploit doesn't mean that something is secure.
It's not the dynamism, or the lack of a main() that makes Ruby & Python scripting languages. It's the fact that you don't have to compile them before executing them.
Well put. Also the advice he's offering doesn't even seem to be that self serving. The takeaway is be wary about getting to a point in a VC-deal where you have no leverage and the other party may still change the terms. That's good advice in general. And what Marc appears to be doing is making the public aware of a trend he has seen in the industry rather than offering tactical advice or opinions.

After all if what he's saying here is not true, then he is a liar and the investors he's talking about know it.
You do know that the Blue Pill exploit was created by the developers of Qubes, right?
Actually A and B are same person. Just two different phases.