skysight-inc/HackerNews huggingface dataset:
Ruby's OptionParser Is All You Need
I can't see any place that a question of yours was downvoted. Perhaps it just seemed so? If you have a more specific question please send it to us at hn@ycombinator.com.
To be fair, the author defined the units of measurement on their second mention, and from then on consistently gave the temperature in both Celsius and Fahrenheit. The fact that he did not specify what scale of measurement he meant when he wrote "10 degrees" does not merit great criticism; it is a simple omission, I would treat it as I would treat a typo...

Other than that, this is a rather cool (no pun intended) experiment. I usually just rested my toast horizontally across the toaster or placed it on a grill after toasting to avoid the dreaded toast sweat. Maybe I'll heat up my plates in the future. More importantly: the toast still cools down. Where does the toast sweat go? Where did it come from?
The new WebRTC sample repo is at http://github.com/GoogleChrome/webrtc.

View samples from the repo live at http://googlechrome.github.io/webrtc.
71, 80, 90, 100, 110, 120 - Did I miss any of these? - 6 different "C" runtime versions (apart from side-by-side sub-versions) for compiler that was released in span of 10 years.

It's not that I like the MSVCRT runtime. It's just that I have to target it. Any popular commercial product that has some form of plugin architecture (Autodesk for example) through DLLs would require more or less for one to compile it's own plugins with the exact version the main application was compiled.

It's a bit of strange moment - when one developer cries that OpenSSL should've not used it's own malloc implementation, and then another cries - don't expose malloc/free interface (but do say your_api_malloc, your_api_free) and this way you can target any "C" runtime.

Now these are completely two different things, but not so much. What if say OpenSSL used the "malloc" runtime - what version of MSVCRT.DLL would've they target? Does anyone really expect to target all these different versions and all these different compilers that you can't even find the free versions now through MSDN?

(Now I'm ignoring the fact that you can't easily hook malloc and replace it with "clear-zero" after alloc function, but that's just a detail).

What I'm getting is that there are too many C runtimes, hell DirectX was better!

I only wished MS actually somehow made MSVCRT.DLL the one and only DLL for "C" (C++ would be much harder, but it's doable).
and a nice chianti
I'm not sure i follow the argument that introduction of information by a middleman is adding to market efficiency. Your note expressly suggests liquidity be be witheld...when trading with people who have information.

As a result, market makers try to focus on providing liquidity to people with consumption preference while avoiding (or charging higher prics to) the informed.

Only to usurp the information to benefit the market maker (or other intermediary party...fronting or not) at the expense of the person introducing information. Or, are you trying to say that person is actually 'witholding' information and by 'appropriating' it, you are then responsible for 'introducing' it?
If he had been convicted would he have also been required to pay for the "damage" done to AT&T's computer?

Isn't there something in the CFAA about having to allege causing damage, measurable in financial terms?

Maybe they did not use that provision?

Surely there must be logical reasons I am overlooking, but I find it peculiar that today technology companies can so easily get federal authorities to bring proceedings on their behalf.

Whether it's the DMCA or the CFAA, these "violations" seem like civil matters to me.

Do they harm the public, or do they just (potentially) harm a business?

I thought this opinion was very clearly written and although it only addresses venue, it does have some precedential value for the future of "CFAA law".

For one, if you plan to rely on improper venue as a defense, stay away from the Second Circuit!
How many of the 13% of the twitter accounts that wrote at least 100 tweets are "robots"?
I've been wanting something like this forever. I hope this discussion gets it going on HN. I think it can greatly enhance the rate of product development. I've got one (or two) I'm well along on but I need specific help and I'd be all over it to help find that.
AFAIK it does not apply to H1Bs, but many other visa categories discriminate based on country of birth / nationality.
No, as there was a lot of warning. Many enterprises spent the two or three years prior to it patching or (less often) reengineering systems, and folks were on watch during the last month of 1999 and first week or so of 2000.

Many very large dollars were spent.

Heartbleed, on the other hand, came out of nowhere.
Ask HN: What's the most valuable blog post you've read?
What is the most valuable blog post you have read for your personal & professional development in the web industry? Any that had an impact on you specifically?
Next Attenborough documentary being filmed for Oculus Rift
HTTP request header overview
His first documentaries gave me I life long passion for nature and animals. I hope they do it right.
I'm getting that too on Chrome 34 and Opera 20. I'm on Windows 8.
Japan also offer loans to USA for building maglev trains http://www.telegraph.co.uk/news/worldnews/asia/japan/1055533...
Reading Cloudflare's blog post[0], they keep referring to the exploit having a length of 65,536 bytes, and how an allocation of that size is unlikely to find itself lower in the heap.

That is true - but this exploit doesn't depend on setting a length of 65,536. The server takes whatever length the client gives it (which is, afterall, the bug). Most of the early exploits just happen to set the maximum packet size to get as much data out (not realizing the nuances of heap allocation). You can set a length of 8bytes or 16bytes and get allocated in a very different part of the heap.

The metasploit module for this exploit[1] supports varied lengths. Beating this challenge could have been as simple as running it with short lengths repeatably and re-assembling the different parts of the key as you find it.

edit something that I want to sneak in here since I missed the other threads. Cloudflare keep talking about how they had the bug 12 days early. Security companies and vendors have worked together to fix bugs in private for years, but this is the first time i've ever seen a company brag about it or put a marketing spin on it. It isn't good - one simple reason why: other security companies will now have to compete with that, which forces companies not to co-operate on bugs (we had the bug 16 days early, no we had the bug 18 days early!, etc.).

As users you want vendors and security companies co-operating, not competing at that phase.

[0] Cloudflare - Can You Get Private SSL Keys Using Heartbleed? http://blog.cloudflare.com/answering-the-critical-question-c...

[1] see https://github.com/rapid7/metasploit-framework/blob/master/m...
Why can't Windows officially include standard versions of this library? You know, like Windows already does with .NET versions since Vista or every other OS does with libstc++ or libc++? Forcing every C/C++ program to bundle their own MSVCRTXX.dll is pretty silly.
This really gives me second thoughts about going into CS, as someone who was born in India (but is now a Canadian citizen (which apparently doesn't matter at all)).
Microsoft C++ supports static linking with the standard library, which you should be using for release builds. That way, your program will always be using the exact version of the standard library that it was tested with, and it's guaranteed not to interfere with anything else on the target system.
What about Elon Musk's hyperloop venture, are they in the running?
I've not yet had the pleasure, but despite the insight lholden's shared about the contentious relationship between the BSDs, I have a really hard time believing anyone in this industry would be so petty.

Its clear, however, that the only way to get to the bottom of this is to become a big contributor to OpenSSH.
Are Google and Facebook Just Pretending They Want Limits on NSA Surveillance?
> They may have been too gentle to kill another humanoid. (...) Obviously, humans love to kill and wipe out entire species.

Wow, projection much?

History tells us that native Americans were just as capable of killing other native Americans as other individuals of homo sapiens. That doesn't make the crime made by European settlers lighter, but that does make the anachronistic idea of "Noble Savages" look like a lame attempt at feeling morally superior to other people of non-native American descent. (Not to mention objectifying native Americans: those peace-loving, naturalist sages.)

Also, "an agreement of peace with the Neanderthals", seriously? We are not talking about Napoleon, we're dealing with many different cave-dwelling tribes, mostly moving around by walking, scattered over Europe that displaced a different population in the course of thousands of years. Your statement makes no sense.
now I am worried with Coburn on it. I don't like his track record.
NSA incompetent?
This article is ancient (pun intended) in terms of paleoanthropology research and apparently comes with some criticism from people in the field:

http://en.wikipedia.org/wiki/Boskop_Man#Criticisms

http://johnhawks.net/weblog/reviews/brain/paleo/return-amazi...

Recommend this story and discussion instead: https://news.ycombinator.com/item?id=6849223
You make good points in this post. We are working on addressing some of them already. I would love to discuss this directly, you can ping me anytime, shykes on #docker / freenode.
This is interesting, can you give some examples of unit omission? As an american I am having trouble thinking outside of my environment. I know I am guilty of temperature unit omission: "It was 10 degrees outside /The high is going to be 60 tommorow." I am having trouble coming up with others. I am having the most trouble with gallons and or miles:

I was running on fumes, it took 3 to fill my car up.

My friends new truck is super efficient for a pickup it gets 35 / 35 miles / 35 to the gallon.

I ran for 3 yesterday.

Buffalo is 120 from Syracuse.
Why did anyone need this challenge in the first place? Couldn't someone have justed ASKED a good exploit developer what they would do and what the impact is? No, I guess we're all up for wasting people's time and creating potential false negatives.
You're right, but it wasn't a misconception. It was a disqualifier. I suppose I should have been more direct when I was not interested in the excuse, but just the answer to my inquiry.
implicit in the free rider problem is that the monetary value of your contribution is less than what you gain.

In this case, I think it's safe to assume that a $200 contribution to OpenSSL won't repay the contributing company $200 of improvements.
When I was at PARC the Mesa guys (who had counted strings) did some analysis and (at least in those days) the counted strings ended up being, in aggregate, faster. I suspect the advantage would be even greater these days since memory allocation was a bigger deal back then.

I wonder if you could do this compatibly in the compiler by adding another primitive type (counted string) which had the length in the bytes before the start of the null-terminated string. You'd need a new type because various routines in the standard library would have to invisibly have two versions for counted and non-counted strings (since if you incremented a string pointer, or used a function like strchr, you'd have to treat it as a regular char). "Safe" code would use a different call (say, cstrchr) that returned an index instead of a char. The compiler could optionally warn on unsafe "legacy" calls as it can with strcpy instead of strncpy.
When the story is about L4, and the reader is interested in operating systems, the answer to this conundrum is "very yes". L4 is an incredibly simple, elegant, and important OS design. I have a hard time reading about it and not wanting to play around with it (thankfully, I've had the opportunity on projects).

Two simple uses for L4: first, as a bare-bones but coherent, complete OS for a purpose-built device; second, as the basis for another OS built on top of it as a "personality". L4 implements most of the hairy parts of an OS (perhaps modulo filesystems), allowing you to build the upper-level OS in terms of L4 abstractions.

This paper is a survey of the last 20 years of that microkernel design, which has been picked up and evolved by several teams. One way to approach it would be to read an introduction to one of the original L4 OS's, and then read this one to see which concepts survived into 2014.
I ride the North East Corridor rails often and have clocked the Acela at 130 MPH via GPS going into Boston, and the Northeast Regional hits 115 MPH in spots from Eastern CT to NYC.

The route is just too winding for those speeds in so many places and you end up going 60MPH for much of the trip.

The best views going north are past the Connecticut river, rolling through Niantic, to New London and the small coastal villages like Mystic, and heading south the rail bridge that runs next to the Triborough gives you a fantastic panorama of Manhattan's east side.

I love the train.
Does Lyme Disease exist in the southern part of the USA?
They were a Y Combinator company. They're drinking the kool-aid, for sure. But seriously, this sounds much more like a VC play than a bank play to me. There are real cost/performance advantages to their model. This could scale to a billion dollar company. That's the sort of thing that attracts VC, which is much easier and more flexible than a bank loan - IF you're talking about real scale potential.
There was nothing pre-approved about the question. Senator Wyden said he sent notice a day in advance that he would be asking the question. The ODNI General Counsel said that Clapper hadn't seen the question prior to the Senate hearing, and tried to correct it after the fact. [1]

Keep in mind that this was a program that everyone on the intelligence committee had already been briefed on. You could make the argument that he misled the American public, but not Congress. Also note that since the intelligence committee knew about the program, any one of the members could have also issued a public statement clarifying the situation, but they didn't.

People liked to harp on Clapper, but Wyden was the one who, instead of just telling his constituents himself (he wouldn't be subject to prosecution, but might have been kicked off the intelligence committee) or putting forth legislation restricting Section 215 collection, decided to put the DNI in the position of either violating the law by disclosing a classified program or telling the American public the "least untruthful" statement.

[1] http://mobile.nytimes.com/2014/01/04/opinion/testimony-of-th...
A plate heated to Murray Temperature seems like it would be too hot to handle comfortably? Did you find this to be an issue?
Example from a memory dump on a vulnerable server (username & password changed to protect the innocent):

`..?...t?.R...t>

...ned....userna

me=0000000+0ew+0

user&password=my

passw0rD.~Jt....

.3z..a..........

One of the things that caught me off guard, but isn't surprising is that some hosting companies don't use VM isolation, thus it was possible to pull memory from other sites which may have been patched. Hopefully hosting vendors that don't have isolated VM's don't also allow users to install their own OpenSSL as this would become a vector to compromise neighboring hosts. Of course allowing any custom software install in such an environment is just asking for it.
ODesk CEO Sees Online Jobs Growth
UMich on Heartbleed: "5.7% of all hosts that support HTTPS remain vulnerable"
Excellent question, it was indeed hot to handle, but didn't burn. http://www.antiscald.com/prevention/general_info/table.php
Phishers hijack EA Sports Twitter to steal user details
Hah.

So Roger Penrose, not content with the now-seemingly-attainable quantum computing, speculates there is an even more magical quantum gravity computing, which brains just happen to use, that makes them special, that Turing machines can't compute?

The man just really hates the idea of AI, doesn't he?
Their culture is different from Apple. They didn't get a perfect product first time. But their revisions have been awesome and the beat Apple on price. Combined with Amazon prime, it does offer some advantages on content.
This analysis doesn't support the conclusion that the bug isn't severe at all. And telling the reader that nobody cares about their email is rather smug. The egos in the security community are out of control.
> However, to me neither seems like a strong argument for routinely releasing multiple updates per day.

I don't understand this line of thinking. If there's a bug that you can fix in short order, why not fix it and deploy said fix? If you've set your CI and infrastructure up correctly, update rollouts aren't something the user even notices.

I've always been a big proponent of small, atomic commits. Being able to deploy just one thing at a time means we often know where breakage comes from (when it happens), and we can respond to feedback sometimes within minutes.

The customers love it, and we enjoy excellent stability and development velocity. These are the reasons we deploy many times a day. There's no reason for us not to deploy things once they are tested and ready.
Its also important to choose your security battles. I imagine there was another severe bug or two in a project as large as OpenBSD.

That being said, thats a petty and ridiculous reason not to deal with someone's code. This gentleman strikes be as a builder, not a maintainer; someone who wants to breeze through town like a cowboy, bring cool ideas to fruition, and move on to the next conquest while someone else keeps the system from falling apart. Thats not a judgment, we need people like that, but they probably shouldn't be the ones fielding emails.
I'm really amazed that Windows has maintained substantial binary compatibility for so long. To be honest, when I see "one way they could've done it was by squeezing the flag into the one byte of padding between widgetLevel and needs_more_time" I think nooope, nonstandard, can't do it, not my problem. Worrying about such things constantly throughout huge projects like MSVC over decades of time must add a whole new level to the difficulty of those engineers' jobs.
Very sad since IIRC Acela was supposed to have its own high speed rail but runs on existing track due to budget
Out of curiosity, since you're a strong defender of HFT here, have you read Lewis' book yet? You mention the hype, but I've found the hype and the substance of the book to be quite different. A lot of the hype on both sides seems to start and end around the first few chapters (one of which was excerpted publicly) and the "60 Minutes" piece.

When I finally finished the book, I didn't get the sense that his target was HFT alone. He heaps plenty of criticism on the bankers, the dark pools, the brokers selling order flow of their customers, the SEC's revolving door and apathy, and (implicitly, with exercise left to the reader) the conflicts of interest of the people selling the SEC the systems (MIDAS) that purport to keep the market fair.

It's the defensiveness of the HFTs and exchanges (like Direct Edge's O'Brien) that has me a little bewildered at why they feel persecuted in particular, when a better strategy might be acknowledging that there are some systemic flaws and look to fix them before another ill-thought out regulatory approach is put into place.

I don't see IEX as a pure white knight, but I do give them props for getting into the arena with a solution for one part of the problem instead of complaining bitterly, spreading FUD and launching ad hominem attacks on authors who are shining light on a whole slew of questionable practices as a lot of the people in the hype machine have done on the financial news channels since the book has been out.
NTIS and CRS are two very different organizations, from two different branches of government. They have next to nothing in common.
E-Sports Reveal How Our Brains Age
Were tests done beyond the 53C temperature, to see if this resulted in a total elimination of toast sweat?

I realize that this may make the plate "too hot to handle", but I'd gladly eat breakfast with one hand in an oven mitt if it would result in better toast.
I'd enjoy a follow-up where they test different materials against the 'keep-toast-dry' 53 degree temperature of clay plate.

Would something like neoprene/polystyrene plates (as insane as it sounds) provide a solution to slightly soggy toast at a lower temperature?

It's one thing to find an optimal temperature, but a completely other beast to find a practical solution to it!
I always thought there was a humorous irony in Mr. Myhrvold's half-baked efforts to eradicate malaria.

That's because IV itself is a parasite.
does the suggested temperature also eliminate toast sweat in different varieties of bread?
I've no idea, but I think having a verbose server header like that indicates an indifference to security already....
I'm not sure that's enough to conclude whether they know of RFC 4343 [1] or not.

[1] http://www.faqs.org/rfcs/rfc4343.html
I've clocked Acela at just below 150mph on my GPS in between Providence and Boston. As I understand it, they would like to go faster in other sections, but the track / catenary isn't able to sustain that speed on most of the journey. Still way better than flying for BOS<->NYC or NYC<->WAS. It's a shame that the ticket prices are 2x what the regional is though.

Never heard about having dedicated rails. It would be nice, since the FRC requires any train that travels on track shared by freight to be basically built like a tank, which makes them much more expensive to make an operate.
How do you know when you've found a piece of a key?
I love this! I am also regularly saddened by the phenomenon of toast sweat. I looked in vain, though, for an RSS (or Atom) feed so I could follow your site, but didn't see one. Did I miss it?
Sure, and for that upside you pay the downside of not knowing when that ever-changing dependency may inadvertently break your application. There's no free lunch.
Sadly I too had to claim Heartbleed on my weekly status report.
Don't worry, I was saying the same thing when he was alive.
If an exchange was front-running customer orders, that would be unethical and illegal. So why is it suddenly OK for exchanges to enable front-running by third parties and profit on their actions by charging insane amounts for colocation and data services?

And - please do answer this - if what we care about is market efficiency and liquidity and there are no problems with front-running in principle, what is gained through the current division of labour except legal obfuscation? Shouldn't it be more efficient to let exchanges screw over their customers directly?
Why not use a cooling rack? Then air can circulate under the toast, eliminating the moisture and removing the need to pre heat a plate.
The Social Media Frequency Guide: How Often to Post
Show HN: Fun Countdown Timer
Perhaps "gentle warming" is a bit of an understatement then.
"Web apps are the future" is the new "This is the year of Linux on the desktop".
The Washington Times? Are you a right wing Moonie nutcase?