skysight-inc/HackerNews huggingface dataset:
SIMPLE NEW SCHOOL WEEK SCHEDULE APP
Shades is a schedule and task organizer which allows you to store everything you need to keep in your mind into one place.

It features:

- Color coded days
- Optional multiple weeks
- Shortcut words to note tasks as fast as possible

With Shades you can create your schedule quickly and start organizing your school life.

iTunes link: https://itunesconnect.apple.com/WebObjects/iTunesConnect.woa/wo/5.0.0.9.3.0.9.3.3.1.0.13.3.1.1.11.9.0.1.7.0
Ideally it should ask for context of where you use it... gpg is logical, but ssh keys should ask for a server to check against. :)
Chrome:

a recursive search on the libraries linked to in Chrome on OSX shows that the OSX system wide Address Book uses OpenSSL. Specifically LDAP. Here is the dependency tree that leads to OpenSSL on OSX Mavericks:

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
/Applications/Google Chrome.app/Contents/Versions/34.0.1788.0/Google Chrome Framework.framework/Google Chrome Framework
/System/Library/Frameworks/AddressBook.framework/Versions/A/AddressBook
/System/Library/Frameworks/LDAP.framework/Versions/A/LDAP
/usr/lib/libssl.0.9.8.dylib

$ strings /usr/lib/libssl.0.9.8.dylib | egrep '^OpenSSL'
OpenSSL 0.9.8y 5 Feb 2013

0.9.8 is not effected so Chrome on OSX should be fine. (src: https://www.cert.fi/en/reports/2014/vulnerability788210.html -- versions 1.0.1 to 1.0.1f)

Safari:

A similar search of safari shows some inclusion of OpenSSL code in the system wide Security.framework as a part of libsecurity_apple_csp. It is unlikely the bug crossed over as the inclusion is limited.

$ strings /System/Library/Frameworks/Security.framework/Versions/A/Security \
| grep OpenSSL
OpenSSL DH Method
OpenSSL DSA method

Firefox:

On OSX it is using the same security framework as safari.
Spotify: Thoughts/complaints about new Your Music feature and Stars
If they don't want to make an offer, say you'll consider offers 30K or higher, and mention that with this offer, you've started looking for buyers.

Negotiate down to 10K if needed (but don't say that).

Don't go below 10K (it would cost them that to build it, and they'd have 0 users and 0 incoming links).
This is exactly my plan and need as well. 7pm and no dinner plans? Instead of take out... Have a soylent.
> Or maybe it's just a bug. There's really no need for tinfoil hat theories unless you have any evidence for a possible conspiracy.

But we do have "evidence for conspiracy". We known for certain that there are organizations with huge budgets that have introducing such vulnerabilities pretty much written into their mission statements. Why would we assume they would not be involved in something they obviously should be (however perverted their goals are)? It would be grossly incompetent of the NSA not to try introducing bugs into OpenSSL.
Observe your OS X Filesystem
Depends on implementation. Memory allocations can lead to fragmentation and thus to waste and decreased performance. That's what's great about using a compacting GC btw.
Microsoft have been making their source code available to academia to study for at least a decade.
I'm watching this right now, it's brilliant! This is exactly the kind of stuff I love to think about, but PHK has done a wonderful job thinking it out to a lot of detail. I suggest everyone drop what you're doing and watch it asap. It's exciting and really holds your interest.
Sure; enjoy: http://tojans.me/blog/2013/03/30/freedom-learning-stuff-doin...
Browse through the National Vulnerability Database, and write down the language of each bug.

Discounting bad PHP, a huge majority of bugs are in C/C++ code. And "past popularity" isn't a good explanation, because a lot of the software is fairly recent.

So, the following isn't an opinion. It's simply a matter of observable fact. If you write in C/C++, you are far more likely to introduce security vulnerabilities than in other languages; therefore, unless there's a pressing reason to use these languages, don't.
Generalization in this case is really unhelpful, since there is almost no diversity in SSL libraries. There is 3 of them, but almost everyone uses openssl.

One case do not make a trend at all, and two cases is the worst statistical proof there is for trends.

On the positive side, open source model of development do allow projects to use not only what is common, but also the exciting fronter regarding security models. My project has used gnutls with pgp for 6 years now, nicely avoiding all those 2 major vulnerabilities, and that was only possible because someone found themselves wanting to implement the new TLS standard that supported pgp keys.
> The Rs 450-crore mission intends to explore the presence of Methane in the Red Planet with the help of five scientific instruments on board the spacecraft.

That is roughly $75 million.
This entire thread is eye-opening. It's as if open source gets a pass on almost everything related to quality because it's free and open. The unspoken belief is that a magic person will come along and fix everything in the indeterminate future. Also, the mantra: "all bugs are shallow."

If you refuse to understand the reasons for engineering, conceptual integrity, and discipline in writing code that needs to be readable (read: dull and boring), then I don't know what to say.
This bug was in fact discovered by a Google employee: https://www.openssl.org/news/secadv_20140407.txt
Would you mind sharing some details about how you do this (make the project go faster)? Is what you bring to the table more of an organizational/process improvement or technical expertise?
Maybe Firefox cant handle it?
Is Your Interview Process Bringing Your Co’s Growth Plans to a Screeching Halt?
Why is his server still vulnerable?
I would try a hard refresh, it's pretty snappy for me (stock Macbook Air and iPhone 5). It's always been really impressively performant, ever since I heard about it some months ago.
A lot of the content tooling for games is usually written in some other more productive language (C#, python, ...), so there is a lot of contact between managed and native even for AAA games, even though very little of what actually ships in the game is managed code. Getting a performance boost (or not having to interop) in a level editor, texture tool etc. will likely be welcome.

The tradeoff between safety/convenience/productivity vs. performance of C# vs C++ for example can't be motivated at the moment, and probably won't be with SIMD. Writing .NET code with deterministic performance is hard, so hard that C# is no more convenient than C++. I think any complex performance sensitive (Web browser, Game, SSL-Implementation...) is soon too complex to be done in C++ and too performance sensitive to be done in managed. Rust can't be released soon enough.
Actually, it is (a weak form of bayesian ~).

http://ojs.uwindsor.ca/ojs/leddy/index.php/informal_logic/ar...

http://lesswrong.com/lw/ih/absence_of_evidence_is_evidence_o...
I don't think anything compiles to native code, from what I understand it's pure CSS3 (which, in the way they're using it, is rendered via the GPU).

Edit: it appears they have a native iOS version, but it's still buttery smooth in a mobile browser.
I am a MsC student & teaching assitant of Operating Systems course and we are considering using Xv6 for more realistic assignments. Right now we give assignments like make a simulator of proces scheduler, it would be much better if they make a real process scheduler under this.
It also doesn't render the 3D stuff in Internet Explorer. So i'm assuming their stuff is Webkit-only?
I was reading about one of the previous members of the Y comb. and they applied 6 times before being accepted.

So, If not this time there's always next time bud. Good luck!
Gamification can play a role in a program for dropouts, but it by no means is suitable as the sole treatment: It just patches over the underlying problems[1], among others lack of robust archivement motivation in combination with lack of learning competence. To worsen things, working class students (who have a higher probability of being a dropout) also attribute bad performance in school with lack of talent rather than lack of effort more often than middle class students. A treatment in a school context that has been shown to be both sustainable and effective is continuous feedback on the relative improvement in archivements of the specific student (school marks comparing the individual performance to the class usually make the percieved talent-mark correlation worse as the high-performing students often didn't need much effort to get their marks). Luckily this is one of the seldom cases where a treatment has stronger effects on the students with learning problems compared to the high performers, too (thats usually a big problem in pedagogy).

[1] Leaving out the the sociological context. I really doubt "boredom" was a real reason, boredom sounds too much like self assessment.

edit: typos
The rise of social spells the death of one-to-one loyalty
Ditch The Printed Coupon By Linking Discounts Directly To Payment Cards
At this point it's safer to say that an intelligence agency is responsible than that they aren't responsible. This is precisely what Schneier, Greenwald, et al. mean when they say that the NSA tactics degrade the security of the overall internet architecture. It's incredibly dangerous.
That's what I exactly tried to convey: I used that tactic when I was a beginner at Java and hadn't many problems with it. I used the same tactic when Generics came up. I hadn't any problems with it. The beginner can become a better programmer by reading the code. Now I am in a state where I can say: "this shouldn't be implemented that way". Which is completely different and grounds in being Java my native language.

I have casual encounters with Haskell since two years now. Library code is still hard to grok. Don't get me wrong: I like Haskell very much and I am pretty sure that its a decent language to write security critical code in, but I think this is still a problem for many beginners out there. I very rarely stumble on something and say: "hey, that's cool, I will use that in my code". But I admit that I give up after the third nested "lift-<whatever>" ;-).

I want the libraries help me understanding the language, not vice versa. But of course, that's not their primary goal.
I don't understand the point you are making with the filesystem. LOC as a single point of reference is useless.
Livestream: https://www.youtube.com/watch?v=YmQMVjCVZBo
Astute.io – Business Intelligence For Startups
More on the vulnerability from cryptographer Matthew Green:

http://blog.cryptographyengineering.com/2014/04/attack-of-we...
>It's not pedantic to ask if you have any good examples of the chemicals you are complaining about.

Sure it is when it's not the point. If you're really stuck there, then just re-read my comment without the word "chemical". You'll find no impact on my point. So, if you disagree with my actual assertion (which seems to be the case, judging from your other comments on the topic), then you might address them, if you weren't being pedantic.

>Derailing the conversation with complaints of pedantry is, however, rather unhelpful.

Actually, I am complaining about others derailing the conversation with pedantry. Important difference.

But, I see that you are unwilling to answer the simple on-topic question that would address all of this; that being, are you asserting that there are no harmful chemicals in the food supply?

Carry on with the downvotes and faux discussion.
Making TransactionScope Work with async/await in .NET 4.5
If you're trying to use .NET's async/await features with Entity Framework 6 and TransactionScope, you may run in to a fun little "feature..."
gnutls has also had vulnerabilities and it gets less attention, I guess you mostly got lucky.

Sadly, it'll never become popular because of the license.
Parallax effect in the addressbar
I have a similar relationship to this game. As kids, my brother and I would stop by the computer lab at Peru State College and, when lucky, someone would dial the line printer terminal into Omaha. The few printouts we accumulated were treasured artifacts.
> I would assume the NSA is interested in gaining access to systems in a way that doesn't allow basically anyone to ride on their coattails.

Don't we actually already have evidence of other cases of the NSA adding backdoors to widely used systems, exploitable by anyone aware of them? Isn't that what the elliptic curve backdoor was? http://www.wired.com/2013/09/nsa-backdoor/all/

Apparently your assumption is quite not safe to assume.

I guess the NSA either figures nobody else will notice the backdoor, or just doesn't care. I guess only they know their motivations.
Does this github project handle the scenario where some of the URLs become dead links or some of the domains expire?
Automatically, these links/domains need not be shown to the user.
> the NSA is interested in gaining access to systems in a way that doesn't allow basically anyone to ride on their coattails.

If possible, yes. However, if they were indeed responsible for this, they'd probably have a couple honeypots to detect exploitation by third parties. If they considered the third party harmless, they could decide whether the vulnerability should be "independently discovered" or not.

Planting a complicated exploit would be harder and increase the risk it could be traced back to them.
Monitoring Series part 2 – Detection and Alerting
Get an offer letter from another company with fantastic salary, bonus, and stock options - Google is always hiring good solid engineers, and so is Apple and 300 other SV companies.

Once you have good offer letter then go to your CEO for a 'man-to-man' talk.

If he has any ounce of courage then he will match the offer or it will be your last day at work.

Good luck!
In my OS course (both as an undergrad and later as a teaching assistant) we used Xinu [1] which seemed to work well.

[1] http://en.wikipedia.org/wiki/Xinu
Starting over with...SSLRef?
Back in the late 90s I worked on a project that needed secure communication. At the time, our reasonable choices were SSLeay or SSLRef. SSLeay was the precursor to today's OpenSSL and obviously free. SSLRef was a commercially available library and cost around $30K to license for commercial applications. We chose SSLRef because we were concerned how our potential customers would react to having an open source secure communications implementation. Years later we switched to use OpenSSL. Kind of ironic, but not the point here.

Anyway, the point of this is that I remember SSLRef being decent code. Debugging it was fairly simple and it had a pretty good structure, which is very different than SSLeay/OpenSSL. This makes me wonder if it could serve as the basis for a replacement for OpenSSL.

It looks like Apple uses SSLRef in some capacity and the source code is available at http://www.opensource.apple.com/source/Security/Security-30.1/SecureTransport/

To be clear, I understand that the license of this code is a problem (perhaps the current copyright holder could donate it?). I also understand that we've learned a lot about various attacks against SSL/TLS since it was written and it surely has not been patched to resolve them. It also does not currently support TLS.

However...assuming the code could be/has been re-licensed by whoever owns it today, would it make sense to use SSLRef as a starting point for an OpenSSL replacement? I mean, wouldn't that be better than starting over with new implementation?
It's easy to see why, without the benefit of hindsight, one might think that the minimal approach was to have the same extensions apply to both DTLS and TLS.
As crazy as its author may be, I think ParrotOS/SparrowOS/whatever it's named now would also make for some interesting studying for those more interested in embedded systems.
Go for Scala (Scalaz lib) AND Clojure: could save you some time.
The last 20 Km of missions like these are the hard ones, once you're off the pad. It's roughly 1/3rd between failure to launch, failure to arrive at the destination planet and failure to land (the latter not applicable here since it is an orbiter).

60% of the missions fail, which really isn't all that surprising given the complexities of a project like this.

Great to see it got this far, hoping that it will complete the interplanetary travel part of the mission around September of this year.

Lots of data here:

http://en.wikipedia.org/wiki/Mars_Orbiter_Mission
Doesn't matter as long as Switzerland responds to any changes in its strategic posture. E.g. that equipment, plenty of which is a wasting resource, can be replenished if its neighborhood gets threatening again.
Well, the 1000 eyes approach has worked with other open source, mission critical software, like Linux, which also doesn't have an official testing suite. If you have enough people invested in making sure something works, there's a strong incentive to uncover bugs now matter how obscure.

Security's always going to be an arms race in software.
Or, more generally, I think languages should have union and intersection types - "(IFoo && IBar) || (IBaz)", etc. (I also think languages should have arbitrary Boolean expressions as types, where the compiler emits a warning and a runtime check if the compiler cannot prove either if the condition will be always met or it won't be always met, but that is another matter.)

Null is just a built-in final/sealed type(enum?) with a single value and no operations defined, like boolean is a type(enum?) with two values.

That, combined with proper type inference, would alleviate a large chunk of the boilerplate associated with statically typed languages in general, and Java in particular. (For how much Java is pushed as moving errors to compile time, there are an awful lot of things that fail only at run time that could be checked at compile time...)

Same thing with checked exceptions. A checked exception is really just an option - return foo or failure.
Architecting OpenStack for Enterprise Reality [pdf]
I wonder how "unvalidated user input passed to memcpy()" didn't trigger all of the static analysers...

I guess that the anaylser doesn't know that it's untrusted - perhaps it's worth having separate "trusted int" and "untrusted int" data types, so this would've been a compile-time error?
Hi, repo owner here. Yep, I'm doing my best to keep dead links out. See this issue for example : https://github.com/vhf/free-programming-books/issues/850
Just with any other github project, you can fork it and submit pull requests to address when that happens.
You must be joking. "OpenSSL is not developed by a responsible team" is probably the most benign criticism Theo has ever issued.

And he's quite right. This is a class of bug that should not exist or, at least, be restricted to the OSs where "malloc() performance is bad enough" to justify using their own implementation. Memory management is a non-trivial problem.
There's a difference between "trusting his audit of the code" and "trusting his code". Any interested and motivated person can audit code. If nothing is found, that might not prove much. But if a vulnerability is found, the audit was worthwhile from some perspective.
Exactly, JIRA's UX was clunky when I last used it in '09, but after using Trac, Redmine, QC, Bugzilla and (God help me) CA USD, JIRA is far superior. Haven't tried FogBugz but I'm a Joel fan, how does the UI compare?
The Humanities Need an Ally: Could It Be Computer Code?
Moore's law "translates" to transistor count. Any other interpretation is your own. I don't care about "operations per second", because (1) it depends on what you're counting and (2) the numbers you referenced aren't necessarily due to Moore's Law.
> And then we'd have potential exploits both in the daemon and in the safe language runtime/compiler.

Now we have exploits for libraries and runtimes that often allow access to arbitrary application data. If this functionality is in a separate process without such privileges, application data will be safe.

> One just needs to keep on looking for exploits and keep on patching them.

This approach hasn't worked in the past and will not work in the future either. Especially when we start with the existing, desolate and probably thoroughly compromised codebases.
The mooted backdoor in the Dual-ECDRBG involves the possibility that the public parameters were generated based on some secret values, such that knowing the secret values allows you to break the generator.

It doesn't allow just anyone to break it - merely knowing the backdoor is there isn't enough.
Yep, I keep on jumping between "love JIT" and "love AOT" in terms of implementations.

Currently my feeling is that most languages could benefit from both.

A JIT like environment for live coding and portable deployment.

And a AOT one for certain types of deployment where thin runtimes are desired.
"The sale was for nominal consideration of $10 and Frere-Jones, who had left Font Bureau, moved to New York and actively worked to build HTF" This should be enough to show that Hoefler is a scumbag - and Frere-Jones a really naive person. I hope that Hoefler will have his business reputation ruined.
Adopting a smart approach to pen testing
That's actually something openssl does okay. See http://www.openssl.org/docs/crypto/threads.html it's actually one of the few things that are properly documented.
The linux kernel is very complex and its become harder to explore and figure out what is going on. This seems to be the right size.

Is minix still kicking around? I thought that was the teaching Kernel.

For looking at linux, they put all the redhat source online via LXR.
Its online, but you should install your own on your own lini install.

http://src3.org/#RHEL6-2.6.32+220.el6/kernel/
This won't stop eve "local chat" being full of obscenities. There are plenty of ways to play games (of all sorts) with a social group that meets your preferred ideals, but when you encounter people outside that group the communication is unlikely to be either pleasant or PG-13. Specifically in eve, but often elsewhere.

I'm well past caring at this point, it's all just words.
Ask HN: Why do none of my submissions show to the public?
I can't seem to submmit things to HN anymore for my original account. All posts show with a red star (*) instead of upvote arrow, and they're hidden from public, only visible to me while I'm logged in. And they don't have a comment form either.

Can anyone explain? Cause I can't find anything about it in the FAQ, rules, Google, or anywhere.

My original/real/main account is: https://news.ycombinator.com/user?id=jimeh
I'm not asserting that there are no harmful chemicals at all in the food supply, just asking you which ones you consider the most problematic and widespread throughout our food network.

(I didn't downvote anything in this thread, by the way.)
For anyone that happens to use PointDNS DNS hosting (it's free for a single domain I believe), I've written a small script to be called from cron.

https://github.com/vortura/point-dyndns
Indeed, seeing that coding style should raise further questions -- if the fix to a huge security hole is somewhat sloppy, what are the chances that everything else is sloppy?
I love Atlassian products. I use it on every project I make, and recommend it to clients when we need a place to keep workflow centralized.

We use:

JIRA - For issues
Bitbucket - For code repository
Confluence - For documentation
Bamboo - For a build server and CI

I'd love to settle on HipChat as well but it's stupidly difficult to get it to pull git commits and other things directly into chat.

Flowdock is much much simpler in usage, UI and integration - so Atlassian team, if you're reading this: Let me 1-click integrate git commit notification into a HipChat room of my choosing, you own both products - make them connect in the easiest most straightforward way!
Unusable on Chrome under Ubuntu on an 8 core xeon with 32GB of ram.
Chrome, Ubuntu, crap laptop. Snappy load and smooth animations, here...