skysight-inc/HackerNews huggingface dataset:
We've actually been wanting something like this for a project we're working on to build a new CMS for part of EFF's website. Initially we were thinking of modifying prose.io to make it more flexible, but this goes even farther.

Unfortunately we're probably too far into dev at this point to switch (we went with a rails app), but this problem comes up pretty regularly for us and I'm looking forward to giving Webhook a try.

Here's a suggestion on the video: instead of having one long recording, create multiple, much shorter ones that explain pieces of functionality.
Full statement: http://twitter.com/ajamlive/status/454724369429045248/photo/...

The NSA has a good history recently of lying through their teeth, and the bit at the end "Unless there is a clear national security or law enforcement need..." is a pretty damned large asterisk.
Sure. That's basically the extend, not replace strategy. Then you can choose various ways to extend.

* You could pick a completely different approach, and define interop points. This tends to have a steep learning curve. E.g. python interops with C very well, yet most people nevertheless avoid interop.

* You could define the old system in terms of the new system or vice versa. That way, you eventually have clear path to use only one system completely. However, it also means you need to at least support all the various crufty bits you may not otherwise care about. It's also not easy to learn.

* You could just extend the old system. You don't get to clean things up by hiding them behind interop or a layer of translation, but at least the learning curve isn't so bad - you only touch what you want.

That last bit is the basically the strategy that wins. Adding a new system is just such a pain unless it entire replaces the old system (which is almost impossible in practice if only for reasons of momentum), that it's really hard to go half way. Also, don't forget that "mere" interop is far from trivial since it's not just CSS, but also javascript's interaction with DOM+CSS that you'd need to emulate/interop with.

So that leaves us with things like flexbox: new techniques, but integrated into what we have rather than side-by-side with complex interop.
Do you use Codecademy? I think I may have spoken to you before. I do not recall, but there was someone who was teaching code online.
HMO:

I built http://findhn.firebaseapp.com in an attempt to help get more people collaborating on stuff on HN. Help me out by going to the website and adding interests to your HN profile. You'll have to add contact info to your HN profile in order for this to actually be useful though.

I would also appreciate general feedback on the site.

HYO:

I'd be happy to give feedback on projects. I can edit copy and be honest.
I’ve been finding mind maps extremely helpful for doing exactly what you describe: working in small chunks through the process of approaching a high-level problem. (I currently use FreeMind for this, but I want to find something that works better on my laptop and/or would let me edit maps on my phone as well.)

I use mind maps like an endlessly hierarchical to-do list. Every high-level task I want to accomplish is a node, and whenever I start to think about the approach to one, I make child nodes for the broad strokes of that approach. So long as I’m actually interested in completing the project, I can continue to break each step down in this way until I get down to a level where it’s easier for me to just start writing code. (This level varies largely, depending on my mental state at the time.)

If I stop at any point I have all the thoughts that came to me, written down in exactly the places they’ll be useful. I can go as deep as I want into breaking down any particular step, knowing that those thoughts will be available later. And it’s much easier for me to spot problems and reconsider my approach when my plans are all laid out hierarchically in front of me.

I might sound overexcited about this because I hadn’t figured out how to use any external tools to help me think about my projects before I was recently introduced to mind maps, and they immediately had a huge impact on my ability to think about my projects without getting bogged down. So if you already have tools that give you similar benefits, take all this with some salt or whatever.

Anyway, I’ve lately been working mostly on weekends and finding myself with similar issues as the blog post describes, so I’m planning to start trying to do a little bit every day instead, starting today. I think I will be content if the little bit I do on some days is breaking down some tasks I haven’t yet thought through in my mind maps, even if I don’t write any actual code.
But that's my point - either you use documents in the way they are advertised and get redundancy or you normalize into many documents with relationships between them and then your documents just degenerate into entities.

I am not saying there are no usecases where a document oriented model fits well, but I argue that it is not a good fit for modeling your average business.
Outlast: Whistleblower Release Date Announced
I need some help with public IPV6 networking on ubuntu. I have a pool of public IPV6 address's that I'm trying to route to private LXC containers and can not figure out the configuration.
Normally when I post submissions and they're dupes, even with a different titles, I am forwarded to that article when I click submit instead of a duplicate getting submitted. Why that didn't happen this time, I don't know. Also, the complete title wasn't fitting the 80 char limit, hence why I had modify it, but I made sure it didn't reduce the clarity or affected the intended meaning in any way.
It would have made C a profoundly different language.
C is what it is; a portable assembler.
I believe K&R had a strong sense of minimalism; fancier string s would be seen as something that belonged in a library not the language.

This has its benefits; _anything_ fancier would have embedded a whole set of assumptions about typical string handling usage for which the design had optimised.

That no safer string handling library became popular can be seen as a indictment of C or a tribute to their tasteful restraint.
Looking to create a new profession?
Depends which page you're referring to.

The article/link above makes the price clear, and also why we charge - we keep things simple and don't do the recruiting model.

The homepage doesn't mention price nor mentors; we wanted to keep it short. We'll likely add the price there.

Both the price and prior mentors (some are very likely to return) are clear on the offer landing page: http://hackerretreat.com/batch-next/ The exact lineup of mentors is TBD because we want to be sure to bring in people that participants want/need. You can judge from our past mentors, and our posts, what the caliber of mentors generally is.
They did, the problem is that the patch immediately shows you the security issue - and distributing a patch means then to disclose the bug.
1. Purchase access to the club for $10K/year

2. Wait for next vulnerability

3. Immediately sell details to hackers via bitcoin

4. ???

5. PROFIT
Awesome site. I'll be honest and say I was expecting something a little 1999 with the .net domain (full disclosure :-P).

Would you like to discuss things privately about your current traction?
I'm not 100% on the timeline but I'm pretty sure the OpenSSL team knew about this well before April 7th.
What other people have said in comments is completely right: OpenSSL, or maybe just this Steve Marquess guy, is missing the forest for the trees. Or in this case, the six figure donations for the pennies. OpenSSL could raise more money in a few months of pan handling in a major city than they raise in a year[1].

A student group that I will soon be President of at the University of Northern Iowa[2] received more in donations and financial support. Our student group is not the best managed, but we care a lot about large sponsors, keeping good relations with them, and making asks that matter.

If someone told me that panhandlers and Midwest student organizations are out-fundraising OpenSSL, I would scoff and laugh. OpenSSL? That's mission-critical software running on nearly every PC and post-PC device in the world. You know what OpenSSL reminds me of in this respect? SQLite.

SQLite charges $75,000 for consortium members[3] to have 24/7 access to phone support direct to developers, guaranteed time spent on issues that matter to them, and so on.

The fact that this doesn't exist for OpenSSL is an embarrassment to project management. I made an offer in that email thread to try to raise $200,000 for OpenSSL by the end of 2014, and I'm repeating it here for visibility:

If you are an employee of a corporation that wants to donate to directly support OpenSSL development by funding staff time, send me an email right now: friela@uni.edu

If you are in the OpenSSL foundation, send me an email right now and I will try to solve your problem by finding a phone number at every major OpenSSL using corporation and making an ask. Want me to do that? Send me an email right now: friela@uni.edu

[1] http://www.ncbi.nlm.nih.gov/pmc/articles/PMC121964/

[2] http://www.unifreethought.com

[3] http://www.hwaci.com/sw/sqlite/prosupport.html

[4] https://sqlite.org/consortium.html
TLS has been subject to a lot of attacks:

http://en.wikipedia.org/wiki/Transport_Layer_Security#Attack...

Plus, since the whole thing is based on CAs, if you can get an intermediate cert (and does anything think the NSA can't?) and you have the means to MITM someone, that's as good as breaking it, too.

15 years ago, we were using keys with much lower entropy, as well, which may have simply been outpaced by computing power.
NSA used Heartbleed nearly from the start, report claims
The prize pool could use to be a damned sight larger though. Heartbleed only qualified for a $15,000 payout: a figure ten times larger would still look a bit stingy for such a serious bug.
IMO a grid of smaller images with some mouseover popup or something with a large image and description would work far better than this.
Worked for Mozilla.
I have two MSc from a great non-US university, working with H1B for a top IT corp in SV. My wife has the same two MSc, staying home with H4.

I have seen similar patterns among other H1B/H4 immigrants (e.g. same university, same education, yet only one of them is allowed to work).

I think the US should do what Singapore has done a long time ago: open up its job market for high-skilled professionals, as it will bring in talent, know-how and experience. Otherwise, as soon as the H1B term expires, all of this talent will go back to their countries, improving their economies. (Not that there is anything wrong with it, but from the US point of view, it is better to have the talent in the US than at any other place.)
The donations are one aspect. I'm on the dev mailing list, been lurking for a few years, I've used openssl for various things for years and I have had an interest in when some newer TLS standards were going to be supported. It's a pure bazaar as best I can tell. It's nearly magical how releases happen. I don't know if there is a secret mailing list for the core developers or some IRC channel or something, people post patches to the list, there are some occasional questions and answers, it's insanely low volume for a project as popular as it is. Every now and again some big patches with a lot of new stuff drop. Every now and again someone ponys up some big money and FIPS certification happens. It just sort of keeps meandering a long without a a benevolent dictator.
HMO, we always need help, to grow

www.mountary.com/blog/2014/4/11/how-can-i-help
That is how twitter jokes look. It is part and parcel of the medium. Better to have the joke look like a twitter joke and get read by an audience, than to make it pure and read by nobody. Really, the hashtags are no more out of place than a smiley face on an email.
> Then why not speed on a track, or some other closed environment?

Because freedom.

> I imagine that shooting guns at targets is fun too - but most people wouldn't find that to be an acceptable excuse for shooting guns at targets in a public park.

What do you think the "we use them to hunt" justification is for the American love of owning guns? The overwhelming majority of people who trot out this justification aren't depending on a good hunt for any real productive purpose; they go hunting because it's fun.
> The reason Uber doesn't buy cars and hire drivers is: 1) it insulates them from legal liability ....

Uber hopes it will do that, and to a certain extent it very well might --- but personal-injury plaintiffs' lawyers are remarkably creative in coming up with arguments why they should be allowed to recover damages (and percentage-of-the-recovery contingent fees) from any deep pockets in sight. Sometimes, some of those arguments succeed in persuading judges.

On a tangential note, I predict someday soon some subset of Uber drivers will be suing Uber for overtime, unemployment benefits, etc., on grounds that, no matter what the contracts say, under the law the drivers purportedly are "employees," not independent contractors. [1] This is a not-infrequent occurrence with delivery-service drivers; see, e.g., Narayan v. EGL Inc., 616 F.3d 895, 898-99 (9th Cir. 2010) [2].

[1] I've long thought that much of legal advocacy could be summed up in two words: Yeah, but ....

[2] http://scholar.google.com/scholar_case?case=1839421424161903...
Monocultures have their own risks.
Workforce and expenses are closely tied together, and those depend on how much you have to spend. You can't spend 20 million dollars or hire 100 engineers if you don't have the budget for it.

I did correct the lowball to 1/100th.
someone below suggested hitting up all the multi-million dollar companies that use openSSL. A now deleted response said something to the effect of "sure, that's easy. I'll just call up the purchasing department."

I don't know a lot about large companies, but I do know a little about getting small companies to give you money. Small companies are cheap, but there are a lot of us, and if you only need $800K, well, that is 800 companies donating a grand a year each. There are many thousands of small technical businesses who can afford a grand a year.

So. First problem, for a small company? You need to give us something to buy. This helps out tax-wise, and it also makes the deal feel better. Hell, you can call OpenSSL a for-profit at that point, which means little paperwork for you, and if you pay out everything you get as salary, you have to pay the same payroll taxes on that either way anyhow, if I am not mistaken.

So, what can the OpenSSL people sell me without causing a conflict of interest? How about advertising? maybe give me a website badge. "OpenSSL sponsor" maybe with a silver/gold/bronze or something (or maybe even just the amount) - Also put me on the sponsors list on the OpenSSL website with a link to my website and maybe my tagline or a logo at the more expensive levels.

I'll take the grand out of my advertising budget and it's all above-board tax wise for me, and the paperwork is easy. I've bought advertising before.
Weev is being released after scrape with AT&T
NAME

strstr - locate a substring

SYNOPSIS

int strstr(string haystack, string needle, int offset);

DESCRIPTION

The strstr() function finds the first occurrence of the substring needle
in the string haystack, starting from position offset in haystack.

RETURN VALUE

This function returns the index of the first character in haystack after
offset where needle can be found, or -1 if the substring is not found (or
if offset is out of bounds for haystack).

Same complexity and memory overhead as C strstr(). Actually more efficient if needle is longer than haystack + offset, which can be checked in O(1) on entry.

(I don't have a problem with NUL-terminated strings, but couldn't resist a little sideways thinking on how an alternate library implementation for strings might work.)
Auernheimer to be set free tonight
So this looks like a powerlaw curve with a fat head and a short tail. I don't see this as a big deal - this means that 56% of people have engaged with a service. I think most people would be happy with that.
Who Pays the Price? The Human Cost of Electronics

https://www.youtube.com/watch?v=ns-kJ5Podjw
I don't understand how ISPs, colo providers, transit operators, power plants, and other 24x7 infrastructure providers can function in environments like this.

Unplanned incidents shouldn't happen regularly, but on the off chance they do, I can't imagine being caught between screwing my customers vs. breaking the law. Talk about a rock and a hard place...
Since a lot of the discussion has moved towards the relative safety of speeding, I'd be curious to see a break down of accidents and fatalities, by absolute speed, by in-excess speed, and by roadway type.

If I had to guess (having been in a number of accidents caused by other people) is that accidents are more common at lower speeds (because they are at intersections and other conflicting right of ways where you are more likely to be going slow) but fatalities are more likely at higher speeds where the safety systems fail to protect those involved.

However high speed accidents are not automatic death sentences as some posters have implied. I was in a head on collision on a small two lane residential street with no other traffic. Both vehicles were going 35mph, so effective collision speed was ~70mph. I was on a motorcycle and the oncoming truck was on a cell phone. He veered into my lane, and I tried to move left but parked cars limited my ability to avoid him. After the collision, I flew for a distance, and on landing my head hit the point of the curb. The two things that saved my life was (obviously) my helmet--without it, by brain would have been on the street--and I had crash bars that were severely deformed after the accident, but they kept my left leg from getting pinned between the bike and the truck.

So relatively high speed accidents can be survivable, especially with modern technology. The only injury I had was a badly sprained hip.
I'm not even sure where this comment came from, and how it applies. This isn't about delaying details to anybody (or, worse, hiding details from anybody), it's about providing details earlier to a group of people who have a strong enough vested interest that they are willing to pay for it and have been vetted as trustworthy enough to allow it.

Given how important OpenSSL is to the web's infrastructure (and the many companies who utilize it), I think there would be value in ensuring it has appropriate resources to fulfill that duty. This idea may not be a perfect solution, but calling it a "stunt" is hyperbole, IMO.
While I know what you're getting at, it is possible to have X > 50% of a sample be better (or worse) than the average -- just being pedantic :)
Perhaps you should look for highschool educators that have taught basic programming in school.

Are you teaching remotely?
It's using RSA with key length of 2048 bits [1], and one can assume that both prime factors have equal bit length [2] i.e. 1024 bits each, and so the size of all the other private components can be derived from that. I don't know what OpenSSL's in-memory format is for this data, I suppose therein lies a good part of the challenge!

[1] https://www.ssllabs.com/ssltest/analyze.html?d=cloudflarecha...

[2] https://github.com/openssl/openssl/blob/master/crypto/rsa/rs...
I grew up in your district and still have some friends+family there, some of whom are politically active. I'd happily put forward a good word for you if you had a sensible foreign policy statement on your Isseus page. But as far as I can tell, foreign policy seems to be left out? I understand you are taking pull requests, but I figure something that important should be written by you, at least for a first draft :)
People who complain about motorists being incompetent often fail to remember the thousands of other cars that they pass every single day without incident. 93% actually sounds low for people who are probably decent enough drivers. It's the rest of them that cause the problems that everyone loves to dwell on.
We have a lot to learn from them.
Statement on Bloomberg News story that NSA knew about the “Heartbleed bug”
In fairness, the "public good" nature of an Open Source security library does create an incentive problem that's well known in the literature, and is probably related in some way to the failure here.

You might have seen the story about how it gets $2000 in donations a year, which is supposed to be enough to marshal the expertise to prevent this kind of thing.

https://news.ycombinator.com/item?id=7575210
Before 1995, the federal government restricted speed limits to 65mph and lower (and prior to 1987, 55mph and lower). When those limits were raised or lifted, those opposing the change howled about how many additional Americans would die with higher speed limits.

The decline in auto fatalities (and pedestrian fatalities) has continued, even as speed limits went up dramatically in many states.
Paypal authenticated pay now possible for Samsung Galaxy S5 and Samsung Gear
Well then keep using those kind of licenses, and openssl, and we the others will gladly use GPL kind of licenses, and move to gnutls and/or polarssl.

This argument is old, BSD vs Linux old since the 1990s.

I guess you are using BSD kernels, runtimes and compilers on your phones and super-computers too?
STATEMENT: NSC says NSA didn’t know about Heartbleed before April 2014
So a glorified crowbar-wielding thug that says:

"Pay your protection fees or else we're heading to the kangaroo courts of East Texas."
The clumsiness of Drew's statement does remind me of those from the Bush Administration when they started to explain why the US Army wasn't exactly greeted with flowers by the Iraqis. Condoleeza will have to do a lot of work to win the "hearts and minds" of the users.
Maybe in a country with better work/life balance, customers are more understanding and willing to wait until tomorrow to get their widgets.
The openBSD foundation is also responsible for openSSH which I think might actually have a bigger install base than firefox...

I wonder if they would get significantly more donations if they renamed themselves to the openSSH and BSD foundation.
I've always wondered how much this is due to culture and statistics. I guess the data for these stats comes from surveys, and I can imagine in America the culture tends to overstate hours worked whereas in France the reverse is true as there is instead a sense of taking pride in not working all the time.
Sounds like an orthogonal problem. Even in France, the law doesn't say you can't work at midnight, just that you can't (usually) work more than N hours/week. You can hire people for non-standard shifts, just not "overwork" them (as defined under the law).

Just like how in blue law states, you can work on Sunday for jobs that need 24/7 support: hospitals, police, infrastructure.
> To things like history of Crimea or its geographical location, for example?

If history and geography trump the current citizens and laws, then the yanks should all fuck off back where they came from and leave it to the native americans and the mexicans, no?

> Have you though?

Enough to realise that something is fishy.

Russian troops invaded crimea, surrounded the Ukrainian military bases, and then declared it was all "legit" because a referendum had 96% voting in favour of joining Russia, despite polls from previous years showing 34% support.

All but 2 members of the UN Security Council voted to declare the referendum invalid - it was only defeated because Russia has veto power.

Your argument is that Russia doesn't get anything out of this. Like Putin is a completely rational guy who does shit because it makes sense, rather than because he's a whack job who pines for the "glory" of the USSR.