skysight-inc/HackerNews huggingface dataset:
For those too lazy to click through:

"Here, we describe a new acoustic cryptanalysis key extraction attack, applicable to GnuPG's current implementation of RSA. The attack can extract full 4096-bit RSA decryption keys from laptop computers (of various models), within an hour, using the sound generated by the computer during the decryption of some chosen ciphertexts. We experimentally demonstrate that such attacks can be carried out, using either a plain mobile phone placed next to the computer, or a more sensitive microphone placed 4 meters away."

Side channel attacks are one of those things that are liable to blow your mind when you first conceive of their possibility. Inordinately fascinating, and one of the reasons that crypto implementations are so much more obfuscated than you'd otherwise expect.

http://en.wikipedia.org/wiki/Side_channel_attack
loved this program when i was working with book-scans!

it saved me _so_ much time and hassle! my best wishes!

-bowerbird
That was the FIRST commit to that repo. Not that it's great reasoning, but really how much info does 'Initial commit.' convey as opposed to 'asdf'?
This wasn't just an overturned verdict, this was a vacation due to process which is different.

Most states offer compensation packages to those wrongly incarcerated. Its usually a percentage of your expected income if you hadn't been put in jail
Web2py does not have an ORM, it has a DAL.
One hand yeah after a while you start running out of new topics. However over the time required to record that many episodes you'd think the state of affairs around SOME of them would have changed, warranting a revisit to talk about the new now.
Does anyone understand what the author meant by the following statement:

${lang} is the language of the future

This looks like a macro for substitution, but maybe its some hip new term I've never encountered. An actual language or just a placeholder for a language that hasn't been chosen yet?
This gets into the real problem: You have a bunch of H1-Bs who have passed labor certification, and will in 95% of all cases get a green card the minute a visa number is available for them, and yet, they can't really switch employers easily, and by the time the application is due, the'll probably be doing a very different job.

So why have a green card limit for H1-B applicants? After they apply, they can work in the US for an indefinite period anyway. So the only difference is that they spend 3-10 years with limited rights that actually depress everyone's salaries. After that much time in the US, they have already immigrated: They probably own a house, their children are American.

Get rid of the yearly quota for people already in the country: It's not as if a more mobile workforce that is already here is a problem.
Five Great Startup Resources
Wow - kind of suprised that there is no reaction here. I do "big time" consulting where this metric is used all the time. I do believe this could be a very powerful service.

Wonder if lack of response is because the startup community doesn't know about these kind of metrics or because it is not tied specifically to metrics which matter for your business (acquisition, revenue, cost, etc). Of course, that has always been the challenge with NPS.
I'd suggest hosting it in a jurisdiction those business owners are not familiar with.
Pretty much the same here. We recently flew to Portugal, and the easiest way to request a special meal from TAP Portugal was to ask them on twitter. The only other option was to call during business hours and wait on hold.
Same guy. He likes to turn up in places like the recent Freakonomics book and the Colbert Report to show off his brilliance. But his actual day job is this nonsense.
The need is to identify a subscriber given an IP address they used in the past (to commit a crime). Knowing who is using a dynamic IP address now doesn't necessarily tell you who was previously using it.
These payouts are for product vulnerabilities; things that Microsoft and Google ship to customers; vulnerabilities that those vendors are effectively creating on hundreds of thousands of machines they don't own.
Does Uber hold patents which prevents competitors or the cab companies from entering the same market?
http://www.weekendhacker.net is solving exactly that problem (by trading skills)

We have a little under 10K subscribers and although we haven't been as active recently we are ramping up with some new features too.

Disclaimer: I am the creator.
Maybe he was an obnoxious asshat in jail too, pissing everybody of? Who knows? Who cares?

Karma 'nuff said...
Hopefully someone doesn't solve this!
This was an eye opener for an engineer like myself.
-Chris
I'd argue that the nul-terminated strings is a direct consequence of arrays decaying to pointers when passed to functions.
I think a monthly or weekly thread would make more sense (same as the "who's hiring" posts).
I've been following grasswire for a month or two now, since I was made aware of it (I've actually linked you on my website as a similar project to one of mine). I'm excited to see it is up now and will definitely be playing with it.

The 'fact-check' feature is fantastic, I'm excited to see how it plays out and hope you get some traction.

You don't happen to have an RSS feed being generated for grasswire, do you? I'd love to play with the feed via xml.

Would love to collaborate you if you need another interested brain to bounce ideas off of, feel free to email me.
I wasn't really trying to mock him or shut him up, but I really do find his argument ("Well, the CIA lied to Bush!") to be a pathetic one. It's the same as the other common equivocation fallacy employed by Republicans ("Look at this long list of prominent Democrats who voted for the war too!"). The Democrats supported the war based on what they were told by the CIA, which is a wholly-owned subsidiary of the executive branch. Any intelligence analysts who refrained from hopping on board Bush's war wagon did so at peril of their careers.

The whole Iraq war was an exercise in confirmation bias. Congressional Democrats certainly bear their share of culpability, but they also have very good excuses compared to anyone in the Bush administration. In an ideal world with Nuremberg-like tribunals, the Bush insiders would be swinging from gibbets, while we'd let the Democrats off the hook after a few years in Spandau. Claiming that the people you hired lied to you is no defense.
It works exactly like an order book at an exchange except there are only market orders (no limit orders).
Contact info in profile

Help me out:
Need to find educators (who happen to know how to code) - My co-founder and I run a 1-to-1 mentorship program turning people into software developers (heavy emphasis on JS + frameworks) need help finding more instructors. We're looking for people passionate about education/love to teach who happen to know how to code.

How I can help:
1) Learn to Program Advice - Was a middle school teacher turned software engineer so I can help people get started on their programming track over a Google hangout consultation (won't sell you anything, just advice)
2) Business Idea Discussion - Love helping out any entrepreneurs talk about their business ideas/models, we bootstrapped ourselves, worked only part-time, and made revenue from day 1
3) High touch sales - All our sales are high touch sales $5-10k++ if you're trying to do high touch sales I can definitely share pointers/advice
Send me an email. I'm learning a lot of JS right now as well and with an interest in crypto-currencies, I may be able to help.
3.x to 4.x Migration guide:

https://github.com/visionmedia/express/wiki/Migrating-from-3...
My opinion on a recruiting tactic
could you talk some more on what is so painful about this ? I'm looking to join a startup that is looking to play in this space (in India) and I'm wondering, from a noob POS guys/experienced developer perspective, what the challenges are ?

is it that vendor docs are poor or is it something else ? I would like to think that system software integration is always trickier than .. say web API integrations.
This is all well and good, but am I correct in saying that we won't be able to use native arrow functions for years. It's kind of tough to be excited about.
If you mess with biggest contributor.. you are going to end up in solitary confinement.

http://www.dailyfinance.com/2010/10/13/the-10-biggest-corpor...
http://www.folklore.org/ProjectView.py?project=Macintosh&cha...
Uber is a complete and total mystery to me. I don't live in the US, but every year I spend at least few weeks in NYC and SF. Yet, I have never seen (not to my knowledge) an Uber car (though I have seen a couple of Lyft cars), nor personally heard of anyone using it. On the other hand, I hear a lot about this company in various online publications, and every single thing I have ever heard about them was negative: that their CEO is an Ayn Randian fanatic, that they hold the law in contempt, that they're exploiting their drivers, that they're mistreating their drivers, and that they're leaving their drivers out to dry if they get into trouble.

I have heard of people comparing Uber to AirBnB because they're both "disruptive". But unlike Uber, I see people use AirBnB all the time, and I've even used it myself on several occasions. I hear both positive and negative things about AirBnB, but mostly positive.

Now, what's the deal with Uber? Seriously, I have never heard anything good about this company nor seen any actual signs for its existence other than its own advertising and lots of negative press. Who are they? Does Uber really exist or is it a fictional internet meme? Is Uber just some boogyman the internet uses to scare people of an imminent dystopia? Is Uber Keyser Soze?
I have been looking at jobs in holland and the tax and benefits are very nice I could end up with both a maxed out UK and an aditional dutch state pension.

Oh and they tax relief of your mortgage payments
It may be the case that Heartbleed did not practically expose private keys. The risk was not overstated in general, though; a virtually undetectable method that has been proved to do things like leak plaintext username/password credentials is still catastrophic.
I have been involved in writing Unicenta POS an open source java point of sale, have you looked at it?
NUL terminated strings were the right decision for C. They’re certainly much simpler than length fields.

Consider using a length field. How big should that field be? If it's fixed size, you introduce complications regarding how big a string you can represent, and differences in field sizes across architectures. If it's variable-sized (a la UTF-8), then you've added different complications: you would need library functions to read and write the length, to get access to the string contents, to calculate the amount of memory required to hold a string of a given size, etc. Very much not in the spirit of C.

Next, what endianness should that field have? NUL terminated strings have no endianness issues: they can be trivially written to files, embedded in network packets, whatever. But with a length field, we either need to remember to marshall the string, or allow for the length field to not be in native byte order. Neither is a pleasant prospect, especially for a 1970’s C programmer.

Also, consider C-style string parsing, e.g. strtok/strsep. These could not be implemented with length-field strings.

Explicit length is better when you have an enforced abstraction, like std::string, but at that point you’re not writing in C. If you have to pick an exposed representation, NUL termination is much better than Pascal-style length fields.

So what was the “one-byte mistake?” The article says that it was saving a byte by using NUL termination instead of a two-byte length field. Had K&R not made that “mistake,” we would be unable to make a string longer than 65k - a far more serious limitation than anything NUL termination imposes!

K&R got it right.
Have you seen folklore.org?
Yeah, if we only used strings marked with 2-byte integers, everybody would have been happy, because 64kb string is enough for everyone. (And let's be realistic, nobody sane would have chosen 4-byte string length back in early 70s.)

So, if we went down the pass, what will we have? All the fun of having "legacy" APIs that seem to work but internally only accept strings up to 64kb length and mysteriously chop off excess bytes when you least expect it. It's Y2K problem all over again.

And just when you finally think you're over with it, memory is cheaper again, size_t is 64bit, and someone invariably wants to store a binary blob >4G as string. Fun time again.

Have we forgotten how much trouble we went through in the 90s to handle memory in x86 "640k is enough for everybody" architecture?
We have no official relationship with CF so they will have to decide to list it on the challenge page. We are a happy CloudFlare customer though!
Makes you wonder if might have a friend at AT&T...
Looks like a really good list. "Business of Freelancing" and "Kalzumeus" have been transformative for my consulting business. Also a big fan of "chasing product". I had been looking for more podcasts in this vein and I'll have to check out more of these. Does anyone have any suggestions for particularly great episodes of any of these?
tl;dr the author argues that the ultra-cheap venture backed services are a problem because while they're using money from VC firms and being patient, they're driving out local businesses, and they'll ultimately fail, leaving a hole in the local service ecosystem.
FWIW, the real (syntax) name of "=>" is "Fat Arrow".

edit: since I get downvoted, source : https://www.google.com/#q=fat+arrow+es6
Is he also Satoshi Nakamoto?
The issue here is not that you don't "deserve" a Green Card, but that your wife deserves to live with her husband in her home country.
You spend 3 hours to MAYBE find out what you're applying for. If you fail, presumably that's the end of the process.
> a country founded on the "self evident truth" that "all men are created equal"

This is the "proposition nation" myth: the idea that America is not a normal nation of a people with a heritage. Instead America is merely a place with some abstract ideals.

This is of course complete hogwash. The founders were very much aware of Americans as a distinct people, despite written nods to some universalist enlightenment philosophe prattle.
Having been through the process of being on an L-1 and having an L-2 wife who is permitted to work, it creates an interesting dynamic. The primary visaholder is tied to the sponsoring company - if they lose their job, both visas disappear. They clearly have less leverage in negotiating salary with their employer, with really only the visa requirement that they be paid a fair rate to protect their interests. The limited transferability of H1Bs gives them a little leverage - L-1s have no such negotiating power, other than the market rate for their skills overseas.

The working spouse, on the other hand, is a relatively free participant in the employment market, so has far more leverage - able to freely negotiate salary (or to start a company of their own, or whatever). Of course they have hanging over them the risk that the master visa might go away at any time and they would be forced to stop working (and probably sell up and leave the country), but there is at least employment protection law to stop employers discriminating against a person who has the legal right to work on the basis of how they acquired that right.
On Gift Economy
Competent leadership is, I'm finding, incredibly hard to come by. Most tech leaders I've had the fortune/misfortune to be under seem to be of the sort where they were in the right industry at the right time, and they were the only game in town. When it comes to demonstrating leadership and innovation, their ideas end up closer to "The Homer" (car on the Simpsons) than even the worst products Apple has come up with.
There's a neat feature in iPhone Safari. If you pull up the bookmarks page, there's an @ sign at the top, and that lists just tweets that have links in them.
As a certified mega-fan (Currently I've listened to 225 of 239 total episodes) I feel like it is my obligation to rep http://www.tropicalmba.com/

If you are interested in hacking systems you'll love this podcast. Things like geographical arbitrage while bootstapping (baseline expenses somewhere cheap, sell to customes where its expensive) and tax "loopholes" like the advantages of a Hond Kong corporation or the "Foreign Earned Income Exclusion" (internet businesses can get 95K completely tax free == 30-40K extra in the bank).

To top it off the two hosts, Dan and Ian, are just plain entertaining. One of their recent riffs about owning fork lift while still being location-independent made me choke on my lunch w/ laughter.

Here are my top 10 of the 225 episodes I've listened to:
http://www.tropicalmba.com/services/
http://www.tropicalmba.com/consulting/
http://www.tropicalmba.com/21-century-financial-script/
http://www.tropicalmba.com/focused-marketing-business-opport...
http://www.tropicalmba.com/remote/
http://www.tropicalmba.com/thoughtexperiments/
http://www.tropicalmba.com/adwords/
http://www.tropicalmba.com/email/
http://www.tropicalmba.com/valetparking/
http://www.tropicalmba.com/predictions/
I love this idea!

What would be helpful for me is the names of any smaller/independent live music or event venues in your area that you know of. Venues that would be best are those that are typically cash-at-the-door or that don't have a good ticketing system or website. I'm working on a simple ticketing system that lets venues like these list shows and sell fee-free tickets and I'm just looking for more beta testers. Send any you know of to contact@showboarder.com and use the subject line HMO

Thanks!
Progress...I have friends that went to the US on a similar Visa. She works..he sits at home. The raw skills are there: This is a guy that can take stones from a nearby hill, build a multi-storey natural stone house and have it pass structural and regulation specs. Now he sits at home and is bored out of his mind because he isn't even allowed to build his neighbors drive-way for a couple of bucks.

I get the need to protect the local people's jobs but that is just criminal waste in my eyes. Both the ability and the willingness to contribute towards the GDP/country is there and yet regulation forces him to watch youtube/paint dry all day.
Forget summarizing the source. How about just explaining who weev is?
Admit it, you read just the title. ;-)

April 1 no more: https://www.facebook.com/NPR/posts/10202059501509428?stream_...
A random thought on this - would topology encompass, say, better ways to unwrap 3D models / project textures onto said models? If so, various 3D / gamedev people might be interested in talking to you...
Same as you (except experienced JS dev). Good low level understanding of Bitcoin protocol (although still learning new stuff every day...). Ping me on Freenode (olalonde) or email (see profile).
The field would become more attractive to Americans and they would fill the empty places.
tell me about it! I rented a Uhaul last year during this time, and it was a complete nightmare. Im wondering how much extra money I have to pay on this site to make it less painful and whether it would be worth it.
I think he means to imply that whoever is making the statement would substitute ${lang} with their language of choice as the successor of C.
This is true for pretty much every ES6 feature - lots of them have shipping implementations in Firefox and/or Chrome, but they've all been hidden behind preferences for years, or are slightly out of sync with the spec, or are half-implemented, etc... Notable examples are Map, Set, and WeakMap, all of which have been behind a Chrome preference for years. In particular the lack of WeakMap makes entire classes of applications much harder to implement in Chrome than Firefox.
for nginx it might not be possible for the intermediate data to be leaked. nginx is single threaded so as long as the intermediate buffers are safely freed or clobbered by the end up the ssl signing method then it won't be possible to leak the key that way. i suspect multithreaded apache would pose a real risk.
I have 2-factor auth enabled on my AWS login - but am I right in thinking that if someone has my API keys that they don't need the 2nd factor?
Storefront: Rent Retail Space at a Store, Market, Mall or Gallery
Heartbleed only exposed SSL memory (like incoming or outcoming connections), but not other memory (particularly not program memory), containing AWS keys.
when they are necessary higher level constructs like these are a boon rather than a hindrance.

We are not in disagreement. Higher level constructs become a nuisance when they aren't really necessary: In other words, when the cost/benefit doesn't work out. Pluggability and proxying are cited as a nuisance when they should not have been there in the first place, often put there by junior programmers who are excited at their discovery. You can think of exceptions as a higher level construct expected to appear everywhere. This makes them more prone to abuse than proxying, for instance.

the construct of exceptions themselves (sans forced handling) is still superior to error codes for the reasons I mentioned.

Again, this is still relative to cost/benefit in individual situations. In the case of go, there would be other costs external to the simplicity of code.
Is it? thenmar was not clear whether the text was advisory or an order.

Though either way, I'm not sure what bearing that would have on how "free" the market is. Employers in some sense exist to entice you to do things you don't fundamentally "want" to do, by compensating you for it.
> ...then there'll be a bunch of people hanging on until the offer comes around again.

This might be the most important aspect of the program. An employee abruptly putting in his or her notice can cause continuity issues for the business, especially if they don't give them the customary 2 weeks of notice. If $5000 can buy employees leaving at predictable times during the year, the business can take steps to ensure that the employee's job functions are covered. That predictability alone may be worth $5k.
There's a sizable contingent (but still a tiny minority) of developers who will outright dismiss anything SQL and typically view databases as these things you kinda pick on a whim based on whatever is easiest to shoehorn your MVP into. Fancy things like a powerful query language, robust data types, transactions, ACID-compliance etc? YAGNI.

Although I don't share this view, I cant say its always wrong. If you're building simple MVPs to find product-market fit for ideas why bother? If there's a 90% chance what you're building will never evolve to need those features, why invest in them?

But if your "product" ends up being a 10% survivor you better have a plan to move to something more powerful before you compound too much technical debt from your NoSQL database. Once you start scaling your business and have to face competition, NoSQL becomes productivity tarpit. Queries that take 20 minutes to write and optimize in the SQL realm can turn into day-long exercises in NoSQL.

The reality is most developers aren't cranking out disposable software used to test the market for new ideas. We're working on things that already have a place, we just need to make them better. For us, the best option right now is SQL + maybe some specialized databases for certain purposes (Columnar for analytics, graph for relationship analysis, full-text for text, etc)
And you get something in return for those taxes in the EU. Like an existing, functioning social safety net, PAID MATERNITY LEAVE, ~35 hour work weeks, and a slew of other tangible benefits. Our taxes go into ponzi schemes to pay off retirees, fund obscene foreign wars, and to build more and more prisons.
Ouch! Are you suggesting that I actually dress for success?

Your conclusion did not cheer me up at all: everyone is doing it so you should too.

It would be nice to get a system where these human flaws in aspiration would work against each other to some mutual advantage.