skysight-inc/HackerNews huggingface dataset:
Ran in to this a couple of times over the last few years. The problem is that the internal group doesn't usually really operate as if they are in the free market, they just get to operate like a monopoly. I had to work with different orgs who were mandated to use the internal IT dept for all projects, but the IT dept had no incentive to actually do any work.

When you needed a server - that will take 3 weeks to set up. Really? It's going to take you 3 weeks to provision a new VMWare instance (cause 90% of the servers provided were VMWare instances). Really? OK. Hrm... There's a typo in the hostname - can we get that fixed? "No, that will require too much work updating our network to accommodate that."

Hrm... OK... Can we get an account for the outside contractor (me) to get on the VPN? "That may be 2 weeks - the person that does that is leaving for vacation on Thursday." Umm... It's Monday now. "There's a lot of stuff to get done before they leave."

I get that there's some benefits to having this centralized - security updates, monitoring, etc - but the impact of waiting weeks for things that should take a few minutes with any company in the real outside world is real (although hard to measure). When the entirety of the org is constrained this way, there's no comparisons to be made to make your case that it shouldn't take this long; many projects should be measured in weeks, not fiscal years.

FWIW, the times I've run in to this in the past... 15 years or so, it's usually academia. My understanding is that this is its own particular brand of IT hell.
Rhetorical question: How many of you who followed through and quit Dropbox because of this have voted in a primary against an incumbent who supported the same policies you are angry with Condoleezza for supporting?
My issue with this is I'm too reliant on the Dropbox ecosystem.

For example many of my favourite applications integrate well with the Dropbox API, including 1Password and YouNeedABudget.

These use the Dropbox API to allow you to backup/sync your configuration files. There's no option in the Android application of 1Password to "Sync with Google Drive" or "Sync with Box" or whatever
I just don't take it out of the toaster when it comes up, I wait about a minute.

In the past I leaned it (like the A-form you mentioned) against some other stuff, like the cup or something.
This story just got flagged off the front page. Can we move the political stuff to reddit?
French TGV runs on a significative amount of non-highspeed track though, and it seems to work good enough (about the same speed as China's HSR, and it has been working for decades).
a lot of people were involved in the decision to go to war. Dropbox is a tech company. I would rather judge it according to the work it does. If they go to war I will leave the ecosystem. But for now not dropping dropbox.
Does Growing Time Lag for Nobels Mean End of Fundamental Discoveries in Physics?
"This meant not changing the size of the class (because somebody may have derived from it) and not changing the offsets of any members, and being careful which virtual methods you call" scares me.

I understand DLL technology have been around for a couple decades now and that it solved many difficult problems when introduced, but, still, this looks insanely fragile.
There's a difference in that analogy, though. You don't want to overconsume calories; you do want to consume as much information as possible. If we were trying to maximize calorie intake over time, corn syrup would probably be the winning route.
Well nobody is stuff that genie back into the bottle regardless of what happens. I do hope the dev is fine though "missing" sounds a bit ominous.
The reasons we don't are pretty good ones. The first, and most important reason, is that native implementations of methods like `.forEach` are extremely slower than their native-for-loop equivalents. For casual side projects, this does not really matter, and some might argue that in newer browsers the efficiency loss is minimal. But when you're developing a particularly JavaScript heavy client-side application, predominantly use .forEach, and your users will notice. The second reason is browser compatibility. `.forEach` is not supported in Internet Explorer 7 or 8. That is an extremely large chunk of potential users.

All that being said, there are definitely ways to gain the same functionality using a utility library like Underscore (or the much-faster-than-underscore Lodash). Instead of `array.forEach` it's simply `_.forEach(array, function(item) { });` - http://lodash.com/docs#forEach
Tu quoque?

http://www.relativelyinteresting.com/wp-content/uploads/2012...
The problem with really awful password interfaces lies mainly with big institutions (banks!) who are unlikely to be influenced by bloggers linked on hacker news.

Ever since switching to a password manager (1Password in my case) I've become acutely aware of how many places have ridiculous restrictions on passwords (especially maximum lengths and character restrictions), and the worst offenders are invariably banks and financial sector sites.
With StartSSL I've get multiple-domain wildcard (8 domains) cert for $59/year (or 2-3 years if you don't need to change it).

This is pretty hard to find in general, and the ssls.com interface does not make it any easier.

For example the same 8 domain wildcard
Positive SSL Multi-Domain: £360

I could revoke my cert a dozen times a year and it would still be cheaper than anything else I've found - happy to be informed of viable competitors at a similar price though (not necessarily lower)

As someone with several side projects (like most of us - I assume) this type of certificate is essential if we are to use SSL at all.
Perhaps you should over-write them with garbage before doing this. Simply deallocating them (or assigning them to new objects) could leave them hanging around in memory until something else overwrites the same memory space.
It sounds like you have everything figured out, the solution is beyond comprehension for mere mortals, and that you'll have 100s of millions of dollars shortly. Perhaps with your new found wealth you can open an IT VC, invest in email filtering, and show everyone here how it should be done. I wish you best of luck in your future endeavors and hope you find success.
Making a physical product that may have to be tailored to varying specific requirements could be difficult, meric above mentioned technology / skill transfer where an assumed solution may not have an optimal effect, or be even be disastrous - I'm sure they're honing an experience set and training and maintenance manual.

Sewage works may be a tangential example. Many sewage treatment plants basically work by sifting heavy material, then using aerobic bacteria to break down dirty water, and anaerobic bacteria to break down the aerobic bacteria (resulting in manure slosh) [a heavily simplified version]. But each plant has varying PH and mineral levels, meaning optimal bacteria are often designed for specific plant locations, and the specialist knowledge required can be very deep.

I see nothing wrong with going it slow, and documenting carefully in a very hands-on way, any hiccup and both 'known unknowns' and 'unknown unknowns' that may be overlooked in a mass roll-out.

[Edit: typo]
Dropping Dropbox to Crush the Minority
Kleinanzeigen
Kleinanzeigen Schweiz , Kostenlose Kleinanzeigen , Kleinanzeigen , Kleinanzeigen Bern
Mall Schweiz Kleinanzeigen , Kaufen, Verkaufen, Immobilien, Autos, Jobs
Mall Schweiz Kleinanzeigen , Kaufen, Verkaufen, Immobilien, Autos, Jobs
Paying Class 2 customers, like myself, are also charged the fee.

Their basic free Class 1 certificates are advertised on their website as “No Charge, Unlimited + 100 % Free” and “No Kidding 100% FREE”.

It wasn’t hard for me to find the provision that revocations cost $24.90 in question 72 of the FAQ, but it’s not exactly highlighted either. It’s probably not something that most people think about; they probably assume that StartCom provides free certificates (and have the automated infrastructure to do so) for publicity and/or to up-sell paid services. And I did actually go to a paid StartSSL service, which I probably won’t renew.

This isn’t to say that I have a “right” to a free revocation, and I should read the fine print, but I think I’m justified in lowering my opinion of their business practices a few notches.
What's the definition of a good proxy?
The worst are the really random restrictions, like "can't have two of the same character next to each other" ...... what???
To clarify what thrownaway2424 said, in case some people really are unfamiliar;

You can't take the password out of RAM. It would be pretty insane to store it in RAM once the login process is done.

This exploit can't read RAM. Being able to read RAM from a program other than the one you are exploiting is pretty unusual today (early operating systems were much less scrupulous, however). There are lots of scary local exploits that can do this by abusing the high level of privileges granted to drivers for things like HDMI devices, but I've never heard of a remote exploit that could read arbitrary RAM. You can sometimes convince a program to dump core if you have a DoS and can run ulimit.

We used to store passwords in /etc/passwd. The user database need to be public. So the passwords stored in it were hashed, and thus were thought to be secure. Along came the Morris worm, which used (among other things) MD4 password cracking to infect systems. I imagine there were less high-profile incidents as well, but the long and the short if it is we how use /etc/shadow for secrets, and /etc/passwd for usernames.

While not secret, I'd certainly call /etc/shadow sensitive, but its a small point.
I know when a private repo is removed on GitHub, all forks are deleted as well. Does the same deletion apply for public repo forks?

I'm sure there are folks with local copies anyhow.

As much as I respect the genius of the popcorn app, a part of me feels that it should encourage purchases.

I now use http://listofepisodes.org to watch my shows and feel good about the ease of use and fact that I'm supporting good content.
Science and Technology – The Foundation of Future India
It seems to me that you would need to exercise a fair bit of eminent domain, and there you might find that the world is indeed smaller.

The article mentions Washington to Baltimore as the first segment to be built. The existing rail lines pass over a number of level crossings, and pass under some bridge spans that are fairly snug for the existing track. And the mile or two before you get to Baltimore's Penn Station are in tunnel. I doubt the tunnel has much width to spare--how much would it cost in 2014 to widen a couple of miles of tunnel under a densely built city?
Crypto is complicated and very hard to do well. Hell, any complex software is hard to do well. There will always, always be bugs. While I am pissed off with so much moaning, and do agree they should be better funded, I think it is more the case of sensationalist blogging taking control of the narrative. Rather than "Booo OpenSSL" we should focus on recovering and raising awareness of the projects we all rely on every day.
OpenTransactions is currency agnostic and doesn't use Bitcoin blockchain in way that I'm familiar with.

It's essentially a open source exchange mechanism based on anonymous federated servers.

I don't see how it's hard to find out about how these things work since literally every one of them has it's own wiki, blog and forum.
Especially large networking gear whose business is dependent on it. I am less pissed at a website using OpenSSL. Funding from the hardware companies would probably have prevented this issue.
Facebook is a controlled ecosystem and based on their previous behaviour they will try to maintain as much internally as possible - which will mean keeping as much media exclusive for Facebook as possible.
The standing up methods are inferior because the parts of the bread in contact with the (cold) plate still sweat. When the plate is hot enough there won't be any condensation at all.
That's a very, very limited list of websites. It would be safer to assume that you need to reset your passwords, revoke access keys, for ALL websites you have credentials or keys on. However you should not do so until those websites have made a statement verifying that they have both patched, AND revoked their SSL certs.
> They had experimented after the fall of Gaddafi in Tunisia, with a sole employee mapping a refugee camp for internal use.

During and after the fall of Gaddafi, tens if not hundreds of thousands of people left Libya, most of them going to neighbouring countries. That comment refers to one of the refugee camps set up by the Red Cross in Tunisia, for Libyan refugees.
Even if there's no publically-known way of using a particular security vulnerability to get access to private keys, how are we to be sure that somebody (perhaps malicious) didn't find a way and are just keeping it a secret?
Comma is actually used for decimal separator in more of the world than the period: http://en.wikipedia.org/wiki/File:DecimalSeparator.svg
I am a paid StartCom customer with a Class 2 certificate, and they’re charging us the fee too.
Find out what the website you are visiting is built with
Your oven is not hot enough.
meanwhile, enjoy your consumer surplus.
Couldn't agree more. Heuristic to use when someone is bashing someone else's code:

Have you contributed (money, code, docs) to the project?

If the answer is no: person lacking skin in the game - irrelevant (even harmful) armchair comment.
Unlike telling people to drop Firefox, where there are good alternative browsers, telling people to drop Dropbox is far more difficult. None of the alternatives come near the usability of Dropbox for everyday users. Dropbox has stayed popular because of its combination of cross platform support, ease of setup, large feature set, and overall stability. Unless there is a competitor that can stand toe to toe in all of these areas, it's simply too difficult for non-technical users to switch.
No I wouldn't - what would I talk about with the other person? Extremely awkward.
I understand the TGV uses weight limitation and careful scheduling to mitigate the cost of other traffic (both wear-and-tear and scheduling), and as in the case of China also has sections of line that are unavoidably mixed, but used, as cost effective alternatives are not attractive. And I think that's the crux: a trade-off between cost and benefit. A new high-speed line is still margins cheaper than a maglev, though that's not to say I'd not like to see maglevs.
There's no "integration" here, only a pointless scaffolding code generator.

I really really hate scaffolding tools. They generate pages of code that I didn't write out myself, that I have no idea what functionality they implement, and that will be hopelessly broken on the first API upgrade in any of the tools the generate code for.

Can we please not have this kind of crap for Haskell? You can say I don't have to use them, but it is worse than that. These kinds of generators encourage poor library design. Instead of the 4 lines of code that I can use to get my website started with Scotty, they encourage a style of library design where I need hundreds of lines for minimal functionality.

If you really want to show people how to use Scotty and Angular, can't you just publish an example as a gist?
Given today's murky geopolitical situation, its always good to cite history as correctly as possible:

"The North Atlantic Treaty Organization (NATO) .. also called the (North) Atlantic Alliance, is an intergovernmental military alliance based on the North Atlantic Treaty which was signed on 4 April 1949."

"The Warsaw Pact was in part a Soviet military reaction to the integration of West Germany into NATO in 1955, per the Paris Pacts of 1954 but was primarily motivated by Soviet desires to maintain control over military forces in Central and Eastern Europe"

[1] http://en.wikipedia.org/wiki/NATO
[2] http://en.wikipedia.org/wiki/Warsaw_Pact
The Factory abstracts away instantiation and configuration details for a complex or dynamic initialization process.

Is there some reason you can't do that by just having this?

func IntializeFoo(f *foo)

The capability to define a function's return type to as an interface type would suggest otherwise

Uh... if you know what type the function is returning you, why do you need it to return an interface? You don't need the interface until you pass it into a function that requires an interface, at which time, the type you've made will be converted for you... why convert before you need to?

Either the consumer should never need to know about types, in which case, you should probably just make it an enum:

type ServiceType int
const (
Weather ServiceType = iota
News ServiceType
)

type Service interface {}

func Service(type ServiceType) Service

Or if the consumer should know about the service types for some reason, you can use the Initialize method above... or to genericize it better, and remove any need for the factory to know about concrete types:

func Initialize(svc Service)

If you can avoid having both sides know about concrete types, it'll make your life a lot easier.
Agree about not having a full app ecosystem like Google apps, however, Amazon keeps their hardware up to date. I've had a couple Kindles of different vintage and they continue to have firmware updates for them.
I just hope that one of their consultants' designers read my blog :-)
Sha1 fingerprint for me is: E0:D2:E0:2E:20:F2:CE:80:AE:16:93:CA:86:2C:5A:14:54:26:28:F5
That's what the article is about, why they decided to not have VS link against the OS runtime.

At some point, the decision was made to just give up and declare it an operating system DLL, to be used only by operating system components.

Makes it clear enough that it was a choice they made, with the big reason being the effort required to maintain compatibility across so many systems and compilers. My knowledge of it never really got past the poking-with-a-stick stage, but apparently (at least some of) the windows SDK compilers were able to link to the system runtime well after they made the switch in VS.
I've tried not to be too critical of the developers, but I do understand where some of the negativity comes from. Have you ever tried to use OpenSSL, as a developer? It's kind of a crufty mess.

* Initialization is even more complicated than the security needs dictate, and so is everything afterward.

* The internal abstractions are leaky, e.g. requiring a poll for read before you can write (and vice versa), because of the way handshakes are implemented.

* The normal error reporting is awful, so you must add extra code to get useful information.

* The documentation is terrible. It's hard to find what you need to know just to write your code, then hard to find information about the "idiosyncratic" command-line tools to test it. Want to know if your certificate code actually works? Have fun fighting theirs to find out.

A lot of people have felt forced to use OpenSSL because it was the de facto standard, or because NSS and GnuTLS were even worse (especially in terms of documentation). That leads to resentment, which has been just waiting for an outlet like this. I'm not saying it's right. I completely empathize with the plight of an under-resourced development team who could use some more help in some difficult areas. All I'm saying is that it's understandable.
Freelancing in Central/South America
It's certainly hard

However, this case would be one of the best cases for it, it's a single instrument, and you could make a careful recording out of it
Python script to detect a prior OpenSSL Heartbleed exploit from a PCAP file
Akamai contributes OpenSSL patch to protect private keys from Heartbleed
This is what helped protect our customers, except for a single edge case for nine days in March 2013. The patch uses a separate memory heap for storage of private keys away from the normal heap. Get it and install it!<p>Read more here: http://goo.gl/loe0iV<p>Get the patch here: http://marc.info/?l=openssl-users&m=139723710923076&w=2
I worked similar jobs for several years.
TIOBE Index for April, 2014: F# Booming, Scala Busting, etc.
Thoughtbot's Phil LaPier on Design for Developers
Chrome says "This certificate has been revoked". It has SHA1 fingerprint 0C F0 6A F0 5C C4 C4 44 E1 DB 92 25 F0 99 4F EC 6B 5E 4A B5 and was issued 2014-04-08 00:00.

Did they renew a certificate after patching for Heartbleed, but then revoke it?
This one is even more concise and avoids the scoping issues that forEach have:

for (var i in cars) { console.log(cars[i]) }

Also, if you're using JS on the frontend, forEach isn't supported by all browsers: http://stackoverflow.com/questions/156696/which-web-browsers...
https://news.ycombinator.com/item?id=547596 - should probably have searched before posting original link :)
My average price for moving is around $100 - though I've paid as much as $150, and the best experience ever was for $120.

The cheapest price on unpakt is $517 for my type of move. They are clearly looking at a different target market.
Hm, and encrypted with RC4 128 bit for me. Maybe it's time to check the client-side cipher settings...
Here's an article about it: http://www.drdobbs.com/avoiding-the-visual-c-runtime-library...

Without the runtime library, strictly speaking you're no longer programming C or C++, hence the surprises...
Precisely!

One large company I know has a technical review system which we use frequently to root cause failure and more importantly to update systems and workflows that will avoid the cockup being discussed in future. Blaming a team or oneself is not entertained (we don't care about the who), the important question is why and what can we do to fix it.

In my opinion, I think the OpenSSL team should come up with such a document and a list of corrective countermeasures.
Navigating the Din of the Startup World (Stick Out by Not Sticking Out)
I'm getting the revocation warning with this SHA1 fingerprint as well in Chrome.
Libgdx works with RoboVM now and the results are very nice. For non-game projects I'm curious as well. I'm sticking with Xamarin but I hope there will be more alternatives in non-Objective-C languages.
What's your time frame for this? I'm really tied up through Monday the 21st, but if you contact me via Skype or Hangouts (see profile) on the 22nd or later I'd be glad to help.

Also you might not remember me, but I think we met at a Startup Weekend in Baton Rouge in 2011? Maybe it was 2010? Either that or some other similar event in NOLA. I'm in Christchurch New Zealand now, but I miss Louisiana something fierce.
PyCon US 2014 – Videos
I wouldn't have put it better myself.
I just added a new update on the website.

Saturday, April 12, 09:50 (GMT-3)

OK, so here's my reply to Nikolai:

"Let me address this question.

> Anything about free revocations there?

It doesn't, but that's not relevant.
It's pretty damn clear: You see the evidence,
that alone should be enough for you to take action.

If you take Mozilla's policy by the letter,
one doesn't even have to own a certificate to be able to request its revocation.
All that should be needed is the evidence of compromise.

If I disclosed the private keys for a certificat I don't own,
would you just ignore that information?
Or would you come after the certificate owner demanding payment first?

You're a CA, A CA!!!
You should be worried about the security of the internet above all things.

You should also be worried that you have a bunch of green padlocks around that don't mean what they once did.
You're not worried about that.
So in my opinion you don't deserve the trust of the internet anymore.

Cheers
Tony"
ScalaJS: How to convert String to String?