skysight-inc/HackerNews huggingface dataset:
Set theory: You should definitely look at Naive Set Theory by Halmos. Despite the name, it's totally rigorous development of ZF set theory with discussion on the meaning and equivalent statements of AC.
Relationship Hack
Firebase turns two today
I wrote that article about nine years ago, and OpenLaszlo never took over the world the way I hoped it would, but Max Carlson, one of its chief architects, is working on reimplementing the good parts in JavaScript/CoffeeScript, without all the baggage. It's a work in progress and not very well documented, but it embodies some wonderful ideas!

https://github.com/mcarlson/rheses

Oliver Steele, another of OpenLaszlo's architects, has written some great stuff about "Instance First Development", a declarative, prototype and constraint based approach to programming modular components that OpenLaszlo supports.

http://blog.osteele.com/posts/2004/03/classes-and-prototypes

http://c2.com/cgi/wiki?InstanceFirstDevelopment

http://lua-users.org/lists/lua-l/2007-10/msg00379.html

http://www.donhopkins.com/drupal/node/124

http://don.fed.wiki.org/view/prototype-based-programming

https://ssl.weepee.org/lps-5.0.x/docs/developers/introductor...

And of course the granddaddy of all constraint based user interface systems is Ivan Sutherland's Sketchpad:

https://en.wikipedia.org/wiki/Sketchpad
I've heard that at some high-end restaurants, waitstaff actually pay to work tables, since the tips on the high bills are high themselves.
In the US, anyway, liquidated damages clauses like this in a contract (licenses are contracts) are only enforced if they are a reasonable estimate of the damages expected for a breach when the actual damages would be hard to calculate. Penalty damages are not enforced.

http://blogs.findlaw.com/law_and_life/2013/05/what-are-liqui...
>the GPL is incompatible with the app store anyway

This project works on OS X, not just iOS.
This is amazing.
Keep up the good work.
I'd be quite happy if governments would give small grants to this kind of every day useful research. I personally eat large amounts of toast so this is an issue very close to my heart. Here in the UK toast is often balanced on it's side against something to avoid this. I believe you can also buy a small toast rack for this purpose. (However I often fear that this cools the toast too quickly.)

I'd be interested to know next if it's possible for the plate to be too hot?
It's very hard to take this initiative seriously. Software vulnerabilities are what software vulnerabilities are: the fundamental enabler of modern network signal intelligence. When you see Obama sign an executive order ending foreign signals intelligence, you can at that point start to believe that the USG is primarily in the business of fixing rather than stockpiling vulnerabilities.

NSA's first and overriding mission is in conducting signals intelligence against our adversaries. As people have pointed out here and elsewhere: regardless of what other missions NSA may have crept into in the last 40 years, when SIGINT comes into conflict with some other NSA mission, SIGINT wins.

(This analysis is descriptive, not normative.)
What's a "novel" or "one-off" exploit? I don't see the realistic dividing line between "NOBUS" exploits that NSA could realistically believe it has a proprietary grasp on and the kinds of exploits that get deployed at Pwn2Own.
Note that while open source can be used blindly, closed source have to be used blindly.
OpenSSL, and the other security problems lately, are just the top of a rabbit hole that is only ultimately resolved with isolated special hardware. Frankly we shouldn't trust our systems, open or proprietary, on the very simple basis they are too complex to verify.

Only by moving crypto functions to a separate user maintainable black box will this tide ever be stemmed. Of course, verifying that black box then becomes problematic, but it would be easier than the current situation.
"Seems much tougher than previous years."

I am comparing these quals with the quals from last year.
It does seem like some members of the community nearly see it this way, considering their reactions.
We had one of these things in the back room of an alumni development office that I worked in 10 years ago, which was used to sign appeals and thank you letters to big donors. I was surprised when I saw it, because I assumed printing technology could do a pretty good job of approximating a signature. I was told nothing could copy pen on high-grade paper.

Another outdated signing technology I encountered when I lived in Taiwan was the "chop" (印章) which was used to sign everything from post office receipts to contracts. It was easily fabricated, and in fact I recall a case while I was there involving a lower-level executive at a bank who made one out of soap and pulled off a scam worth tens of millions of dollars.

But when I pointed out how easy it was to copy, my Taiwanese friends pointed out that Western signatures could also be copied.
A static analysis framework could treat certain typedefs specially since it's parsing the C code anyway.
Realize that in making such "ethical" obligations, you invalidate the openness and the license will not be compatible with any FSF/OSI approved license scheme.

Then of course there is the issue of enforcement.
Contrast this with the recent NSA statement[1] made about heartbleed. This is how they intend to interpret this decision.

1. https://news.ycombinator.com/item?id=7575802
> "If tipping is necessary in restaurants to promote good service, why isn't it equally necessary in other contexts?"

Maybe it is.

No Tips vs Tips:

Delivery:
Package/Letter (no tips): constant missed deliveries. poor to
non-existent delivery scheduling.
crushed boxes.
Food (tips): reliable delivery within the hour. delivery person
knocks on the door more than once. never found a pizza
carelessly thrown into the bushes beside my door.

Luggage handling:
Checked luggage (no tips): constantly lost.
Porter/redcap (tips): the people you go to if you *actually* want
your luggage taken care of.

Service/Repair:
Cable (no tips): only able to schedule service during inconvenient
hours a week in advance, with service windows so large
that I need to take a day off work.
Plumbing (tips/negotiable pay): I have gotten plumbers to my home in
the middle of the night.
Apartment repair guy (no tips): Ahahahahaha....

The one counter-example that I can think of is cab/uber service. There is a hell of a lot wrong with the cab industry though.
I thought Godel, Escher, Bach was a total snooze. It was like 800 pages of Hofstadter trying to prove he was clever.
"Obama exploited heart bleed" isn't a very accurate statement.

It's almost as inaccurate as "NSA says it should disclose exploits."
Coding Malware for Fun and Not for Profit (Because that would be illegal)
> – in most circumstances —
Apple has all the resources, and they had the "goto fail". You should not underrate open source. Bugs are shallow, but that can never mean every single bug. Some bugs will always be overlooked, no matter if open source or closed source.
Also I'd be interested to know how the room temperature affects it. If I eat my toast in my fridge will I get less toast sweat? What should I set my house thermostat to? My guess is setting the room temperate as high as possible (and as close to Murray temperature as possible) would be best but I'd like to know for sure.
MIT finds a 15-year-old inventor in Sierra Leone
She Loves Me, She Loves Me Not in C
(I'm sorry if I do this incorrectly; first time posting plus I'm on an app)

"Serge tried to explain why he always erased his bash history, but McSwain had no interest in his story. “The way he did it seemed nefarious,” the FBI agent would later testify."
Whom is the FBI agent referring to, McSwain or Serge?
A moderation team catching a criminal act and reporting the IP address of the criminal doesn't do much good if there's no way to determine whose IP it is.
spend SO MUCH time on the 3rd. I have too much fatigue to even read the 4th now...
As a Gentoo user, we always did it on our laptop. Build time was about 30 minutes.
"warning: eroticism unused in function main"
Well there are people who write about failures and I love to read about it.

check this
http://www.cbinsights.com/blog/startup-failure-post-mortem

not to mention this list too
http://www.cbinsights.com/blog/biggest-startup-failures
> But Mr. Obama carved a broad exception for “a clear national security or law enforcement need,”

Or a law enforcement need? So this is almost pointless then. Don't expect regular iPhone or Android bugs to be reported, because law enforcement uses them all the type to tap people, so of course in their view there's a "need" for them.

He should've just left it to NSA only, and for very specific cases, if at all. Everyone else (FBI, police, DHS, etc) should be reporting the exploits.

As it is, don't expect them to reveal more than one relatively major bug every 2 years or so - and even that sounds optimistic, I think.
This is a very important point. It's also necessary to recall that cable TV, broadcast TV, and subscription TV mostly gets its revenue from US-based consumers. In contrast, US-based advertising gets its revenue from consumers all around the world (though many of them are from the US). Just in terms of capturing the American market: internet advertising still has a long way to go.
This "change" is so nuanced as to be essentially indistinguishable from the status quo.
I think most crazy behaviors are largely caused by a lack of being educated. When you're a little kid, you don't know how the world really works, and you don't understand science and the laws of physics, so you think imaginary friends and such could be plausible. I'd bet the effects of schizophrenia are much worse at a young age for these reasons.
Custom Spotify Playlists
Less excited people won't know what makes some problems acute and some not so much.
ServerPilot - Free alternative to cPanel for PHP-based sites
Nothing but pandering, and not even a very good job of it. Business as usual down at the NSA.
Internal Documents: Samsung Wants To Abandon Android
This disagreement has spread into multiple branches of this thread. I'm going to try to consolidate all of my responses here to keep things from spinning too wildly out of control.

> I'll suggest that you probably (and quietly) agree.

I agree with most of the literal text of what you have written, but you still continue to ignore the salient fact that this is an unprecedented situation. The continued existence of large numbers of potentially compromised certificates undermines the entirety of X.509 because you can no longer trust the green padlock. The more un-revoked certificates exist in the wild, the less you can trust the entirety of X.509.

Under normal circumstances this wouldn't matter because the number of certificates that get compromised in the normal course of events is small, so the risk of encountering a compromised but un-revoked certificate is small. But in the current situation that is not the case. Vast numbers of private keys are potentially compromised with no way to know, and until something is done about that, the entirety of x.509 is undermined. Cert revocation is far from an ideal solution, but it's better than nothing. At least it offers the possibility of rejecting potentially compromised certs.

In the face of this unprecedented situation, Start's refusal to make any kind of contribution towards mitigation cannot be defended simply by saying that their users should have read the TOS more carefully because those users are not the ones who are being hurt. Everyone who relies on x.509 is being hurt (hence, externality). Start is in a position to make a major contribution towards the mitigation of this problem and the restoration of trust in x.509, and they are refusing to do so. They are entirely within their rights. But it is also not unreasonable to criticize them for choosing not to contribute to the common good.
Ok, I'll take out the last bit about rudeness since it was at worst a borderline case and a distraction anyway.

I'm also going to follow your suggestion and bury this post, since there's little if anything of substance here.
I have some small insight into the internal equities process. As a general principal the NSA prefers that the crypto be strong and if they want access to just steal the keys.
> too complex to verify

There is a verified optimizing C compiler, CompCert. Admittedly, it is not gcc, and it is not easy to do, but still. Writing a verified SSL implementation is probably not more difficult than that.
What about Lawvere's Conceptual Mathematics or Sets for Mathematics?
Isn't the problem that cryptography, solid protocol design and secure software development are actually almost unrelated disciplines that just happen to overlap in some applications?

I don't see why an OpenSSL developer would need either of the first two skillsets at all. Ideally, yes, but not necessarily.
Ask HN: Minority Report with NSA data? 
Just a thought experiment. Can we prevent crimes from happening with NSA backed data? Can we use AI to predict the actions of individuals and then take action before they do? Like using browser history patterns and linking it with suspicious phone calls and online posts etc.
> "You are not going to see the Chinese give up on ‘zero days’ just because we do"

This is a dishonest argument - many of the zero days held by the Chinese are likely to be the same zero days being withheld the N.S.A., so by disclosing them the N.S.A. would be dealing a huge blow to our adversaries' offensive capabilities.

The NYT should have gotten a quote to counter-balance this argument from a "senior intelligence official" (upon whom they shamefully, but predictably, bestowed anonymity). Now many of the people reading this article will come away believing this is akin to nuclear disarmament, which is a totally inapt comparison.
You need to talk to a lawyer.
You're right, I've mixed up things.
> upon whom they shamefully, but predictably, bestowed anonymity

I'm with you on the rest of your points but not on this one. Balance would be nice but anonymity is often key to good reporting. There's nothing shameful about soliciting a quote and then keeping that person anonymous.
These Aren’t The Patent Trolls You’re Looking For
Nicely explained.

One thing I have to tell novice experimenters a lot: A failed experiment is not when you get a result different than the one you wanted. A failed experiment is one where you don't learn what you set out to learn. Which can also be fine as long as you learn how your next experiment can be better.

This was a successful experiment.
I wrote a libxml2 binding in Haskell (http://hackage.haskell.org/package/libxml-sax). It was an absolute nightmare, in part because handling entities safely requires a lot of hoop-jumping (and I'm not even 100% I caught all the places libxml2 does unsafe stuff).
Sweet! Just added it to the readme.
As far as I know Amazon's affiliate service uses a special link with an affiliate code in it. Based on this it would appear he's NOT receiving a referral fee.
I created a repo so people could post and get on site http://prefinem.github.io/HelpMeOut/
Terms need to be better defined. Android uses a Linux kernel. But Android completely cutoff the typical user land that Linux devs/users expect. Android replaced all the good user land C stuff with their own JavaVM (Dalvik) which has terrible repercussions for developers. Android replaced glibc with Bionic, which doesn't even pretend to be ANSI compliant. It is impossible to write an Android app in pure C (NDK) and you must always go through Java/Dalvik.

That said, the only way to fix these problems is to fork/redesign/rewrite Android.
Gandi are free if you have domain hosting with them.
This rule is fine for blogs where each article had an overt title that can be (and should be) referred to.

However, for simply linking to arbitrary websites, the "title" is often meaningless and does not convey the purpose of the submission. In these cases, I would argue that the title is part of the submission, and should not be messed with (unless it breaks other rules regarding spam, trolling, linkbait etc).

Just my 2c...
Yes! That's part of why "get out of the building" is such a popular Lean Startup mantra. More generally, I tell novices to cycle between qualitative and quantitative learning.

For example, I recently had an idea, so I did a bunch of interviews with potential users. That gave me enough information to form a quantitative hypothesis: if I offer users app X, then Y% will use it regularly over a two week period.

Whether that fails or succeeds, my next step will be to talk with users. If it succeeds, the interviews will tell me where to take the product next. If it fails, interviews will help me distinguish between a fatal failure (e.g., nobody will ever use this) or a fixable one (e.g., minor UI issues make friction too high for frequent repeat usage).
Honestly, it seems like the only way the US could get credibility on this "front" is to create an open, well-funded agency whose only purpose would be to enhance world Internet security. Give it a mandate to be entirely separate from any would-be signal intelligence exploiters and let it loose. Yes, I'm sure something akin to this exists but if this had 10% of the US intelligence budget, it would be an eye-opener.
That was also my first reaction. It seems like just another lie even before it finishes leaving his mouth, another predictable broken promise, a priori.
Take it seriously to the extent that they need to consider whether or not hoarding a vulnerability is likely to enable other powers to carry out SIGINT against important US sites.

Consider that while something like Heart Bleed would be an enormous asset to the NSA, if both NSA and a foreign powers found out about it at the same time it'd provide the foreign power with a disproportionate benefit because they'd likely have fewer other ways of infiltrating many sites.

I'm sure that in situations where they're confident they're the only ones with the knowledge, they'll still hold off on releasing anything.
"This is MIT licensed"
There is usually more than one candidate title on the page. When a title heading from the page (or, in rare cases, the first sentence of an article) contains an obviously more informative title, it's ok to use it. For example, when I scrolled down I saw "Brain games to make you smarter" in a heading, and used that instead.

One thing we try (really hard!) to do is not to impose words of our own on the content, but rather use what's already there. You can nearly always do that with one of the original titles. (I use the plural because many if not most articles have multiple titles to choose from.)
I'm surprised no one has mention Mathematics for the Millions by Lancelot Hogben. http://www.amazon.com/Mathematics-Million-Master-Magic-Numbe...

He takes the approach of starting right at the beginning of human history when we first came to look at the stars and seasons and try to understand why they work, and then builds the math knowledge with each lesson. Excellent book!
The discussion on Reddit is fairly worthwhile, including a link to the fathers AMA as well as various link and quotes discussing the family:

http://www.reddit.com/r/todayilearned/comments/22uw9c/til_wh...
Just above you: "miweiss: I've had an app rejected from the selector search the article mentions."
Heck, places in the U.S. need water, why start in Ethiopia where the trial costs will be higher?
Call it paucity of imagination on my part, but I was wondering if somebody could make explicit some legitimate examples of situations involving a "clear national security need"? It's not like they're just making a legal exception for a "Blockbuster" scenario, where terrorists are about to nuke a city and a lone hacker saves the day by breaking SSH, right?

Is this supposed to apply to instances where the flaw affects the competition more than civilians -- say, a security flaw that somehow disproportionately affects Iran, China and Russia over the US? (there are obvious reasons why the government cannot explicitly acknowledge this, but I'm wondering if this is a direct implication)
I don't think he's lying. I don't think he understands what he's saying.
save 15% if you takeout and avoid inflated drink prices? takeout and in-restaurant could still be the same price...
Nanosecond Scale Remote Timing Attacks On PHP Applications
Step 1, find 0% humidity, where are you going todo that where people are living? Strawman.
When Apple upgrades their code, they'll have the same "distinctive string" and the cycle continues. Or do you suggest people go in potentially tens or hundreds of classes and change manually the methods and their use?
That's a common legal loophole. Many acts are illegal under BOTH state and Federal law. That gives prosecutors two chances to send you to jail, if they decide they really want to get you. To stay out of jail, you have to get acquitted TWICE (and pay for your own lawyers both times).
Passionately loving the domain is a double-edged sword. Sure, it can drive you to make something awesome. But it can also drive you to make something awesome for you personally, but that nobody else gives a shit about. Or, more subtly problematic, it can lead you to make the software equivalent of quirky indie movies that are, at best, marginally profitable.

I also think passion is something you can develop over time. I've worked on a number of things where I had no initial interest. But I do like making users happy, so I get excited about the domain via seeing what gets users excited.
Because of a PR push, nothing wrong with that.
Right, and the MIT license is GPL compatible, so people can incorporate this project into GPL projects. But they're considering adding anti-Apple restrictions to their license, which would make it GPL incompatible.
I'm not against all anonymity, but in general, anonymity is bad for journalism. It makes it impossible for readers to judge the credibility of the source, and puts people who want to challenge the source at a disadvantage. It permits the source to say whatever they want, without any fear of it harming their credibility.

In narrow circumstances, such as whistle-blowing where the source would face harm from a disclosure of their identity, anonymity is both appropriate and essential (and in such a case it's essential for the newspaper to do as much verification as possible before conferring anonymity). But a government employee spewing pro-government propaganda does not need the protection of anonymity.

Edit: reworded for clarity.
Ask HN: Why do you do what you do?
I thought I loved web development, but recently I feel like I’ve plateaued. I’m not wealthy, and now it feels like I’m working just to survive, not out of some divine passion. It scares me because I’ve recently turned twenty and I feel I need to start making some decisions.

This got me thinking about all the other people on HN. I know some people here can be very evangelical about their work publicly, but I want to know the true reasons people here do what they do.

Do you work to survive?

Do you genuinely think you’re changing the world?

Do you just love what you do?

I think knowing about other people's situations will help me a lot. Thanks.
Private crypto keys are accessible to Heartbleed hackers, new data shows
You can now push your HMO's here: https://news.ycombinator.com/item?id=7579648
Ask HN: how did successful companies got started out?
Hey HN, can we compile a list of documentaries/articles/whatnot of companies that got started, especially in their very early stage. What marketing tactics they used, how they hired their key people, how their product evolved, etc. I think it would be really interesting to go through them and draw inspirations for our little startup someday.
Thanks!
What was asinine about my comment? I knew cheapsslsecurity was a reseller and I specifically said "from a CA" in my initial comment and then again in my first reply to you. I said from a CA because I was thinking about Comodo and their RAs history of awesomeness.

What is the significance of the fact that they also resell other companies certificates?