skysight-inc/HackerNews huggingface dataset:
> I'm afraid they are spending a lot of effort cargo-culting on the wrong things, while missing where the real challenge lies: How to deal with the inevitable orders-of-magnitude increase in transaction size/complexity while preserving consensus-based distributed verification.

Umm... that's exactly one of the issues that we're cargo-culting about the most. There are two general categories of solutions to this problem: technical increments (ie. a better constant factor), and fundamental cryptographic upgrades (eg. the stacktrace challenge-response concept we have been talking about on our blog). The first category we are not yet doing because we are following the well established advice of "don't prematurely optimize". The second category, well, that's why we're thinking of ideas like distributed blockchain storage, clever algorithms to force more people to be full nodes, and challenge-response protocols. There is also another idea I was thinking of, which I'll have a post up over the next week or two.

In the long term, we are already beginning the development of a very widespread collaboration with academic groups to try to tackle the problems in cryptocurrency, and at this point we fully expect we'll end up releasing Ethereum 2 at some point in 2016 which would take a lot of new cryptography into account.
But R is free!
This cannot be. Your passwords (the ones you are trying to protect) must be encrypted using your master password. LastPass needs to decrypt them somewhere using your master password. What you are describing is how their browser extension seems to work. However, their website does not require the extension to work. So either they implement security in JavaScript that's running within the page (cannot by definition be done securely), or they store all your passwords in a way that they can decrypt them (invalidates the use case for LastPass).
I agree with you. If you build your site with Progressive Enhancement then there really should be very little you need to do. We never support IE6, but generally will support IE8 and occasionally depending on the client need to support IE7 too. Sometimes the css is screwed up with IE6 (if we even bother to test it) and it's just a case of a small tweek to a style but we wont go out of our way to fix it (or make any thorough testing)
I also work in healthcare software, and we've decided on skipping IE7 and IE8 software. It's all about what you can convince your client to let go of. It makes sense to run modern and less bug ridden browsers.

If they attempt to access using older browsers, we bring up an explanation page taking them to an ever green browser of their choice.
Is it cost-prohibitive to ship test devices to each of your engineers?

I have worked on an embedded systems team where some of the employees were remote. The biggest challenges were with sharing details for reproducing specific issues, but emailing videos and lots of conference calls made it a functional environment.
There's a Kubuki Dance aspect to this dialogue. They want to know if you're interested. You say sure, how interested are you? The path forward, first seek to understand who they are, what there motivations are. If they are serious, engage them in a live conversation, preferably face-to-face. Ultimately, the market value is determined by how much someone is willing to pay.
Yeah, at a certain point you cross over from configuration into scripting. Emacs Lisp is definitely in the scripting zone, on purpose.

Yes, Apache has a crazy amount of configuration in httpd.conf, and supports conditionals and scopes, to the point where they had to write a syntax checker for it. I would actually consider httpd.conf a good example of the "softcoding" anti-pattern.

A certain amount of configuration is good, and deliberately providing a scripting DSL language for your program is also good if appropriate.

But when you inadvertently cross over from normal configuration into absurdly complex configuration that resembles a crappy scripting language, giving you the feeling that you're in this big grey area between code and config, that's an anti-pattern.
...the dude who made the skin should've made a better job?
Not sure if it's intentional or not, but on the Timepickers example the "Time (as a number)" live demo cannot be updated. Doesn't work for me in FF or Chrome.

http://mgcrea.github.io/angular-strap/##timepickers

This whole thing looks really, really, nice. Kudos.
Python is a scripting language. People who write python are "scripting," not "programming."
The Rise of Peer Networks in the Innovation Ecosystem
Great decision. I hope in US something similar will happen. But somehow I doubt that it will in the current sick climate.
No doubt V8 is much more mature than MRI, I think some language considerations do still apply though, JavaScript doesn't have method_missing, problem #5 doesn't apply, I guess there is more.
Redefining How Marketers Think of Live Events Real-Time Engagement
It's not a vulnerability. It's a BACKDOOR.
Wasn't Facebook's domain, or at least their whois record, hacked via Mark Monitor in February? At least that was the initial report; I'm not sure what happened and it's hard to find a credible source about it. Here's the best I found in a short search:

http://thenextweb.com/facebook/2014/02/06/uh-oh-syrian-elect...

Of course if it was hacked it wasn't necessarily Mark Monitor's fault; it could be Facebook's (though good security would anticipate that some customers will have poor security).
I suppose that depends on how remote you want to be and what their availability is for occasional on site work. I've worked several places where I've done work remotely that was integrated on one specific, specialized system. I did most of the work remotely and then every once in awhile we booked a hotel close to the final site and did a week of testing.

It requires a lot more up front planning. It doesn't work as well for an "agile" environment. Although from what I have seen it is difficult to make "agile" work in a specialized hardware environment anyway.
SSL Labs now check Heartbleed Attack
Good idea. Here's my Clojure script: https://github.com/danneu/onetab-to-pinboard
Every day tons of great articles slip into obscurity

Can you provide examples? This is the problem we're going to work on next, after we've made some progress on comment incivility.

(I'm going to demote this subthread as off-topic so it doesn't interfere with the real discussion.)
What if it came out that his personal views (and political donations, more importantly) were against interracial marriage or women's suffrage? No one would bat an eye at his losing his position as CEO (voluntarily or not). Everyone is just shocked because our society is finally starting to recognize anti-gay bigotry as abhorrent as racism or sexism.
Hook-up Truck: A modern dating solution for safe sexual adventuring
Don't do manual, repetitive IT ops tasks. Save time using Epsilon (Idea Device)
There are dozens of hobby and one-off projects that I've been doing manual wiring for that I would _like_ a PCB but haven't been able to justify the price.

Example: http://www.ebay.com/itm/1pc-DIY-J-edition-12AX7-vacuum-tube-...

I'd like to buy in bulk and I really don't care of the PCB quality because it's just to mess around with.

Also, after talking to a few people this is a really good marketing strategy. Last year it would have been great to be able to go through one company for proto-pcbs then when we had ironed out all of our own kinks we could have placed an order for 'production ready boards'
You can use Stripe only, PayPal only, or Stripe + PayPal. When using PayPal only, you cannot collect subscription payments -- due to the limitations of the way I'm using PayPal.

Snappy Checkout shows prices in USD no matter which of the 3 above pricing options you choose. So, it is currently limited in that way.
"Unless you're in SF". isn't there where most startups are? so if many of them use ruby and rails in SF why it isn't the main framework outside SF.
What I find strange is that I have a VPS setup on Digital Ocean, with Ubuntu LTS + OpenSSL 1.0.1 + a manually compiled Nginx. This combination should have been vulnerable, yet my website is not reported as vulnerable by the tools I tried for detecting the vulnerability.

Maybe DigitalOcean issued a fix without me noticing? I also updated my Ubuntu packages, yet OpenSSL is still at 1.0.1.
Call it anecdata, but I found switch.ch really hard to deal with: raw admin interface, odd billing, etc. As far as I know, they control .ch
Patching the OpenSSL Heartbleed Bug on Ubuntu
Thanks for the feedback, we have updated the blog post to include some information regarding this.
Why Windows XP users are more vulnerable to threats
The passwords are decrypted locally on your machine using javascript not on the lastpass servers.
ssh doesn't need to be restarted. As you said, OpenSSH never uses the vulnerable part of OpenSSL code. When the ssh service was started, libcrypto (which isn't vulnerable) was loaded into memory and made available to OpenSSH code. That memory isn't going to be invalidated if libcrypto's on-disk copy changes.
It is curious though why this submission got up voted to the homepage and the previous two times it was submitted that it never went anywhere

This is easily explicable: it's the luck of the draw. There is a lot of randomness in which stories get promoted from /newest vs. fall through the cracks.

We're working on an idea for reducing this randomness.
It was about a year between the first release of 2.4 and the 2.6 release. Should we expect another full year for 2.8?
Show HN: sanctum – a blog engine for google app engine
Some comments and questions as well here (total noobie):

1) I can't comment on the viability of getting great clients by going big consulting firms, but it feels quite indirect. And probably can't expand developing experience as noted.

2) Seems very ideal and in fact something I'm trying to pursue right now, but I suffer from the classic chicken-egg problem where I can't get clients without having prior clients.

3) Seems more like a natural extension once you grow your network enough

4) Sweet spot. I'd love to find a small consultancy, you'd get the best of both worlds, steady flow of clients, but nearly the same flexibility as being an independent consultant. Are there resources to finding those unicorn consultancies? I'm doing mostly Rails/full-stack work, but most consultancies seem to be either local or not that flexible with part-time/remote
I wouldn't worry about that too much.
After a lot of trial, error, and attempted code injection, I found that it was much easier than I had expected. It can in fact be solved with a single character.
Reawaken interest in Chain-Archeology
No, for most of our projects, the test systems are small enough so that it's not cost-prohibitive to ship. I just know that every time we bring up a new system or board, there can be days of debugging stupid problems, and that's with everyone and all our electronics gear in the same building.

You say the environment was "functional". For you, did the advantages of having the larger applicant market outweigh the disadvantages?
Growth Hacker's Toolbox (Updating)
This was mine:

var r = Math.random();
me.move(
r < 0.4 ? 'right' :
r<0.6 ? 'up' :
r < 0.8 ? 'down' :
'left'
);

Works eventually :)

For level 13 I just used:

me.move(Math.random() > 0.5 ? 'right' : 'down');

And regenerated the map until I got to one that could be solved by moving only right and down.
MAPI is an API to access data about all pharmaceutical products available in USA
I don't want to get too caught up in quibbling over definitions, but I do feel like there's a point worth making here: There is a difference between a "consultant" and a "contractor", and I think it's worth being aware of. It may or may not matter to any given individual, but to some it will. And to be fair, some of this is subjective, but here's the way I've observed it over the years...

First of all, what do I mean by "difference between consultant and contractor"? Well, if you go off as a freelance / solo developer, your business card may say "consultant" but you'll still be "just another developer" in the eyes of most clients, and in that role you're really just a contractor. That is to say, you're contract labor... just a cog in the machine, another brick in the wall if you will.

If you're on a 6+ month engagement where you show up every day from 8-5 and write code in a cubicle all day, you're probably more contractor than consultant.

OTOH, a "consultant" is seen as having valuable and highly prized insights and knowledge, and is paid to help solve a problem, or work through a situation... which may or may not involve writing code.. if it does, it would probably be highly specialized code that only a small number of people could write. But ideally, if your "consulting" you would be doing just that - working with a high level executive (CTO, CIO, VP) or at least a mid-level manager, and providing them knowledge and insights to deal with a situation.

If your work product for an engagement is a report or presentation of some sort, and one or more recommendations about what the firm should do, or what choice they should make between a set of competing alternatives, then you're in more of a "consulting" role.

Anyway, that's my take. Like I said, some people won't care about any of this. But it matters in that a "consultant" (per the above definition) is seen as more of a colleague / peer to management, isn't necessarily sitting in a cube from 8-5, and generally isn't seen as "hired labor". If that kind of thing is important to you, I suggest specializing in something where you can be paid to sharing your insights, not just for writing code.
This GIF Shows the Meteoric Rise of Boys' Names Ending in 'N' (USA)
"Build outside-in. (Frontend first, backend later)

Building inside-out can lead to wasting time building things that just aren't needed."

I will keep it in mind.
We've posted a full update on the blog: https://blog.heroku.com/archives/2014/4/8/openssl_heartbleed...
We implement everything in JavaScript on that page if you're trying to login from the website -- which is as secure as that page load -- LastPass recommends people utilize the extensions to mitigate this risk.

Our choice could be to not allow people to utilize the website but it seems like educating people of the risks and letting them decide is the best policy.
Microsoft: Thank Ballmer, not Nadella, for Office for iPad go-ahead
MediaFire Takes Its Desktop Apps Out Of Beta, Removes File Size Restrictions
It's not an app but a companion who learns your habits with time and suggest you an optimized way to complete tasks.
Thanks Shifu!
This looks great. I've already signed up as I've been looking for a replacement for Gumroad for awhile now. Their UI just isn't suited to physical subscriptions. This looks much better.

Found an error: My login date under sessions is "Sat, Dec 30, 1899 @"

Feature request: product variants ie. shirt sizes, phone types, colors, etc.
Pitch IT leaders with an idea that you're a college student looking for part-time/contract work in sys admin or business analyst roles. Look for small to mid-size companies, outfits you haven't heard of with less than 500 people. You'll find them more flexible, welcoming, and easier to work with than Big Firms.
Is the vulnerability, or this script to exploit it, platform-specific? I tried this script against a Raspberry Pi running Raspbian with an unpatched OpenSSL library, but received an unexpected EOF.
I don't believe there's any evidence on that yet, so please cool your jets. One dev wrote that line of code but anyone could have made that mistake.
Colo. Suspect Bought 4 Guns, 6,000 Rounds of Ammunition in Past 60 Days
yup it seems to have been patched soon after I posted, however quite a few from here are still vulnerable:

https://github.com/musalbas/heartbleed-masstest/blob/master/top1000.txt
Microsoft Office iPad Team – AMA
How about a 'citizen's income' instead of benefits?
While stock service support is good (EC2, S3, etc), we've had terrible support with Elastic Transcoder. 1 week+ on an issue that completely breaks HLS video encoding. We switched to encoding.com because I get to talk to a human being, over the phone, and aren't put through a support forum.
yes. But it's more like I'm not interested in stuff forever. if for a few months I use a lib, and wish to send a patch or something, then life move on, I change job, I replace the lib, etc. I have to subscribe, get spammed, find a way to unsubscribe filter the thing etc. Whereas on the web, I decide when I go reading and if it's not relevant to me, I don't go anymore and that's it. Nobody cares if I put my answer over or under the citation, and anyways, if anything has already been said before, they will tell me to read the ML history which lies... on the web, where it belongs in the first place.
Designers like sexy, developers like geeky, that's always been my reasoning behind it. It's a shame too because end users don't seem very interested to use a product if there isn't a sexy interface. I also think the money has to do with it, I can work for 3 months a year and have enough to live on, I'm not sure most designers can pull in money like that, can they?
I can't support this app. Batman's mom is dead.
If you're passionate about continuing to build out the vision of this project, you're probably not going to agree on a number. If you're happy to take a little cash for it and move on to the next idea, or even if you're not sure about the first point, I would put a reasonable number out there based in some measure on the value of your time in getting it built (ie, the amount of time it would take someone similarly skilled to replicate it), plus some premium.

Entrepreneurs always have lots of ideas, so you need to simply decide if this is in some way your "one great idea", or just an "easy come, easy go" etude.
In the Netherlands a monthly stipend is given to the disabled to be used on sexual services. The rationale is that not having a way to express this basic human desire can lead to mental anguish.
Good to know this feature.
Pixel And Dimed: On (Not) Getting By In The Gig Economy
How do you verify that the information is correct independently?
Yep. Still time for $drinkOfChoice. I threw my whole todo list for today out the window this morning.
Smartphone battery charging – in 30 seconds
What a shame, maybe now something will change. I won't miss typing in passwords at all.
You could try creating a new load balancer, attaching your instances to the new ELB, and destroying the at-risk ELB(s).
It's from somewhere on the heap not the stack. You can influence where on the heap the data comes from by adjusting the size of your request, amongst other tricks.
Ah, comforting lies. Here's mine: "My data isn't important enough for any of this to affect me. "
In practical terms, right now FBX rules and we can hope that DAE will replace it (right now most DAE support is via the FBX libraries, so let's not all hold our breath). OBJ is great for simple geometry and UVs, but kind of hopeless beyond that.
I agree that I can't drop support for IE 8 or risk losing customers. On the other hand, if facebook/youtube/wikipedia were to do it, and they were the bad guys instead of me, I'd be very happy.
"Are there resources to finding those unicorn consultancies?"

Great question. AFAIK, there are not.

I have tended to only find out about them by word of mouth after spending some time in a particular area of specialization. Back when I was doing Flex, Universal Mind and Digital Primates were well-known in that arena. You tended to see them in conferences, and some of their employees were the ones who authored the best known technical books on Flex. So there is one idea: find out where some of the renowned bloggers, authors, and developers in your field of interest do their consulting.
What tool is he using for editing his cookies?
If you are expecting faster speeds you will likely be disappointed, you're still going through the network you're on.
No, I asked that question because of what he wrote, "People with a gay agenda have made a choice to stand in the way of progress. That means their actions negatively affect the people around them, malevolent."
Am I missing something, or doesn't the browser have to explicitly check for key revocation? I know the checkbox was off in my version of Chrome. Maybe I set it, but I'm not sure.

This [1] Seems to suggest that Firefox, for instance, only checks for EV certs?

[1] http://news.netcraft.com/archives/2013/05/13/how-certificate...
You are not submitting your master password to them. It's been a while since I completely understood the login process, but this should be mostly right:

1. The encryption key is a local hash of your email address and master password. This never leaves your computer.

2. Ignoring PBKDF2, Your encryption key and your master password are again hashed locally. That is sent with your login email to LastPass.

3. LastPass hashes Step 2 with a salt and that result is then used to authenticate you. After any additional two factor auth verification, LastPass will send your password file, which is decrypted using the result in Step 1, that has never left your computer.

You're more than welcome to inspect the JavaScript code yourself. They have a simple encryption, decryption page so you can see exactly what LastPass does.

https://lastpass.com/js/enc.php
For options #2 and #3, how do you go about getting your very first client? I can imagine the dialogue when you've done a few projects and you've got a portfolio and perhaps references, but how do you get the very first person when you're just "some bloke who thinks he knows how to write software." ?
Post Flat Design
RE: The “Tyranny of Structurelessness”
Thanks... and noted. Custom checkout fields are on my to-do list.
2.4 introduced text indexes for full text search as a beta, and 2.6 finishes the job of fully integrating them into the product - they are fully supported with the new release (including in the aggregation framework).

In terms of how they compare, I'm not familiar enough with Elasticsearch to comment, but for basic test searching needs, the implementation in MongoDB is pretty decent. More here:

http://docs.mongodb.org/manual/core/index-text/#text-search
So if I want to be hired as Rails dev. I should have Mac!!!. Great joke
Building Houses
The pink engineering pieces don't solve the princess problem. It does bypass it. A young girl who has learned in her schools social circles that girls only play with cute 'girly' looking toys that are pink (gender roles enforced in our society), would more likely agree to play with these 'feminine' engineering toys.

This is a good attempt at targeting parents who are rigid and scared of shaking gender norms.
But using it would reveal it if anyone was capturing traffic of SSL requests. "Why in the world did they do a heartbeat test . . . hey, what's all that stuff . . . OHMIGOD."
For example, Lars Bak (virtual machine master) is the head programmer of V8.

http://en.wikipedia.org/wiki/Lars_Bak_(computer_programmer)
I can sorta see the value in Atlassian, with Jira being used what seems everywhere.
TodoMVC is more cryptic than finding your own way through JS libraries/frameworks. I never understood the point of that website. Maybe I'm missing something!
EditThisCookie extension: https://chrome.google.com/webstore/detail/editthiscookie/fng...
True, but since V8 is open-source, shouldn't it now be possible for the Ruby developers to borrow the techniques from it that made Javascript so much faster?
I just tried to submit the same thing. This seems particularly relevant to how difficult it's going to be for the Internet to recover from the heartbleed bug [1] currently being discussed everywhere on HN.

[1] http://heartbleed.com/
Did anyone else click on the link hoping for a demonstration of a Google Ventures product at Kevin Rose's house? I was a little disappointed.