skysight-inc/HackerNews huggingface dataset:
No, Krugman is making the point (in his whole blog post) that price "gouging" allocates resources in the best possible way, and that our emotional response to it sometimes confounds this "first best" outcome. Which is actually a good description of the debate we're having here (on the broader thread).

You keep saying "your personal cash flow" as if I or Krugman or others actually do make a buck off selling services to those in distress. I work in climate policy; I don't sell anything. You seem to think it's not even possible for me to actually, really, think that our natural, emotional responses to price "gouging" does us a disservice. I don't have anything to gain except a world that works a bit better.
I can't think of any real use I would ever have for one of these and I see crap like this every day here, on kickstarter, techcrunch or any other aggregator. I don't even own a smartphone or get service where I live.

And I want one right now.
On Beauty: Modern Lies, Underlying Meaning and Inherent Conflict
Heartbleed FAQ: Akamai Systems Patched
Given this, it might be nice if applications could be split into pieces, anonymized, and then each piece reviewed and accepted/rejected separately over different days by different people. (This would also mean that a re-application would look no different than an initial application.)
SNAPDRAGON 810 will support 4K Display and 55 MP Cameras possible next year
I've found that when signing up for things, a lot sites don't allow the "+" in the email. They'll throw a email validation error. But at one point this was a good technique, I just think many sites have either don't allow it or can easily get around it
That's exactly why they chose it. It's more in reference to the ubiquitous foodstuff made of ambiguous contents, a bit tongue in cheek, but clearly we are meant to get the reference, and at least for now we can be pretty sure it's free of people.

http://www.fourhourworkweek.com/blog/2013/08/20/soylent/

http://robrhinehart.com/?p=474

http://motherboard.vice.com/blog/soylent-no-food-for-30-days

^Soylent's response: http://blog.soylent.me/post/66807143901/this-morning-vices-b...
Ok, so is TLS Heartbeat accessible in every service that uses TLS?

The big one that comes to mind aside from https is smtp/tls, e.g. port 587

Edit: Apparently a PoC on STARTTLS has already been written, so smtp/tls is definitely vulnerable
Speaking of the obvious, I'm somewhat surprised that the PEP didn't discuss dropping the "dot" function and using the existing function call operator directly. It seems like a natural idea to me. After all, a matrix represents a linear transformation, and a linear transformation is ... a function.

If you add some whitespace and squint just right, it even kinda sorta looks like math. If you further wrap all matrices and vectors in parentheses, you can pretend it's a whole new operator that lets you do matrix multiplication by juxtaposition.

S = ((H) (beta) - r).T (inv((H) (V) (H.T))) ((H) (beta) - r)

Still, I think this is more readable:

S = (H @ beta - r).T @ inv(H @ V @ H.T) @ (H @ beta - r)
There are several articles about this, journalists got preview runs of it and several ate soylent exclusively while being closely monitored by doctors. Their health was not negatively affected in any way, except for having pasty, greyish poop :P
Also, because brick-and-mortar stores don't raise prices (often due to price-gouging laws), people who find themselves in a store with bottled water, for example, will buy much more than they would have if the water was suddenly $50 per bottle. They buy more than they need, leaving none for people who need it just as much but showed up to the store 5 minutes later.

When demand exceeds supply, there will be some mechanism by which some demand will be satisfied and other demand will not. In the case of hotels, it's price, in the case of water in an emergency, it's randomness or physical strength grabbing bottles in the grocery store, and in some cases the government steps in and starts rationing goods.
Maintaining your bike properly from the time you fall in love with it – Part 2
This should be taken with a very large grain of salt. Firstly, its author, Mircea Popescu, has a long history of not being the most trustworthy character, and often deliberately incites flamewars. I say this not to discredit the arguments in the post by discrediting their author (that would be fallacious), but to warn readers against taking his words at face value.

Now, on to the points in the post.

>As best as anyone can currently discern, Bitcoin does not have a core group of developers.

There is, in fact, a group of developers which contribute the bulk of the new code to the Bitcoin-Qt client. This includes essential security updates and new features. They also have a certain degree of leadership in the Bitcoin community, and their word was enough to get a majority of miners to switch to one client version during the hardfork (more on that later).

> The “Bitcoin Foundation” / “Core Devs” group of scammers have quite publicly, and repeatedly, promoted and vouched for Butterfly Labs, aka BFL

I am not a fan of BFL. Whether they are malicious or incompetent does not matter with respect to the financial damage they have done. More importantly, they did not provide adequate compensation for their unrealized promises after the damage was done. However, I will need to see evidence of the Bitcoin Foundation endorsing BFL before I believe it. Additionally, while one or more developers may have endorsed BFL, this does not mean all developers which contribute frequently are in a cabal together.

> The “Bitcoin Foundation” / “Core Devs” group of scammers have quite publicly, and repeatedly, promoted and vouched for MtGox

Please see my above response and substitute "MtGox" for "BFL".

> Systematically attempted to block, slow and hinder protocol specification and development

Such an accusation requires evidence.

> Deliberately and quite maliciously created a blockchain hardfork in March 2013

Without evidence, we should assume it was accidental, not deliberate. In fact, I would assert that the evidence we have strongly implies that the fork was accidental. The hardfork only occurred because of a specific block that was "too big" (simplification). Additionally, the bug which caused it existed for a while before the fork occurred. Then, many of the core devs worked with miners to resolve the fork in such a way that every client managed to reunite on one chain.

> which allowed our enemies - whoever they may be - to effectually stress-test the entire project

This is a nonsensical statement. The fork revealed no new "weakness".

> Deliberately and quite maliciously tried to meld the BleedingHeart openssl vulnerability into the Bitcoin code.

Again, we should assume they did not know of the vulnerability. If they did, then this point should be expanded upon and not blended with the rest of this post.

The post ends with vaguely threatening text which I will not quote here.
The Story of Mister Macintosh
Going through this right now. Loved writing internal developer docs in github markdown. Quick and painless. Confluence...not so much.
Say I'm logging into flickr.com with my Google account - what's at risk in that case?
Sorry to hear that you are having trouble with Bamboo. I'm Product Manager for Bamboo at Atlassian, so I'd be interested in looking into the problems and use cases you are having issues with. Feel free to drop me a line at james@atlassian.com and ill setup a time to give you a call.
Well, content management is handled by Confluence.
1. Other libraries do exist -- NSS, GnuTLS, etc.

2. Do you have time for a rewrite? What makes you think anyone else would?

3. The (generally correct) mindset is don't implement your own crypto. This is particularly true of something like TLS, which is complicated and has subtle requirements that are easy to screw up. Unfortunately, this means that even people who have time are discouraged from doing an OpenSSL rewrite.
Terms to be aware of: Tacit Collusion [1], Price Leadership and Price Signaling.

[1] http://en.wikipedia.org/wiki/Tacit_collusion
it's pretty hard to do something better with the current status of Rack
Assuming from your username that this is your site, sorry if that's wrong. Anyway, how do you define a "startup"? Some of these companies are over a decade old (eg Atlassian), some have over a $B of funding (eg Dropbox), and a couple (Box, GoPro) seem to be pretty much at IPO. Also they're all in America, is that intentional or could you genuinely not find any non-US startup valued at over $225M?
Many universities do this, but usually only after the first pass of applications is removed. Also, even though 5% of the applicants are admitted, a much larger fraction of the applicants are completely qualified (i.e., if you selected a group of applications 3x the size you can admit, and then randomly selected 1 in 3 of those, you'd hardly be able to tell). So at that stage, multiple reviewers would help but not fix the randomness problem.
> You're also assuming that profit-gouged emergency supplies are necessarily limited.

You're right, I'm making this assumption. I have to make this assumption assuming there are at least a few possible suppliers (i.e. a few gas stations or convenience stores) because otherwise there would be no supply shock and concomitant price increase.

> and you've got enough bottled water to comfortably supply your community

Here I would say you're begging an important question, which is in regards to who has this and other important information? How would a convenience store owner know that the overall bottled water supply in the area is enough or not - and how could they possible make those calculations in time to properly allocate the water? Prices are a great way to spread information and incentivize people to get creative in finding a solution. If bottled water prices go up 10x, I guarantee you people will find a way to get more bottled water there.
I've been watching Soylent for a while now, including following the different home-brew recipes[1].

The verdict is still out on whether you can actually live off this stuff. If you're curious about the experience, there have been a number of journalists who have gone on the stuff for a short period and wrote about it. [2][3].

EDIT: To clarify, there haven't been any long-term studies that I found on living off a nutritional shake like this and the effect that it has on your overall health. It's akin to the same stuff they feed people who won't/cannot feed themselves[4] except a lot cheaper and (hopefully) tastes better.

[1] http://diy.soylent.me

[2] http://motherboard.vice.com/en_ca/blog/soylent-no-food-for-3...

[3] http://gawker.com/we-drank-soylent-the-weird-food-of-the-fut...

[4] http://www.washingtonpost.com/blogs/wonkblog/wp/2013/03/14/r...
Calm down, it's a static HTML page without any forms in it. There is no reason why it needs to be encrypted anyway.
yah they should've named it Gdheegh.
All I'm saying; know your audience. :-)
Haha, we actually did think about this when building it. The smartphone notification feature is a major selling point, but we also wanted it to be useful without a phone.

The touch sensitive cap lets you cycle through all the 'moods'. A lot of friends that have seen it love it for the music moods alone (microphone picks up the audio in the room).

We'll also be adding in a feature that allows you to turn the lamp on to full white and back off just by holding the top (really nice if you need to get up in the middle of the night).
the rails team is waiting for a patch to do it
I really have no idea what this crap about Tumblr is. I don't use it, and I don't really know anyone who does. When I click a link to it, it's almost always a cute animal picture or a piece of art that has no relation to any controversial subject. If there's something more to Tumblr, I wouldn't know, and there is no reason to assume I would.

People raised not to call others monkeys are not somehow the result of the latest social media fad.
> I'm glad I didn't listen to the naysayers, the Debbie Downers, and of course that nameless C guru from long ago, whom I owe thanks to.

That's great to hear that you didn't let the negativity stop you.

I was recently told "If you're going to get bogged down trying to get the lexer/parser to work, you're not ready to work on a full blown language/compiler." Hopefully my story will go the same way as yours.
My undergrad ( Texas State University ) had the problem recently where they accepted the higher number, expecting the smaller number, and then most of the higher number actually attended :P It was the largest freshmen class in the school's history and let to a more... relaxed policy for sophomores living off campus.
It's not harder to find the insecurity. At all.

It's harder to get a generic exploit that will give you access to a lot of targets. But I'd argue that finding an exploit for a particular target would be easier.
HipChat isn't like SnapChat though. If you go to their homepage, right up in the header they've got a link to their pricing page. You don't have to wonder who they're selling you to or what convoluted monetization schemes they have, Atlassian makes money because people pay them for a service that they think is valuable. Which is refreshing.
Apparently we don't have enough eyeballs.
I highly recommend fixing the style before attempting to read: https://www.dropbox.com/s/euuuyrjydo8z5jy/Screenshot%202014-...
slack.com

edit: I contacted the developers and they were super fast to patch everything, roll keys, etc. It's contained now.
Just because I signed up for a job doesn't mean that I have no right to try and make that job less unpleasant, using the force of the collective if necessary.

After all, that's the whole point of progress. How dared our ancestors complain about working 12 hours a day in dangerous coal mines when their own ancestors worked 16 hours a day under even more dangerous conditions? IE4 vs. NN4 was trivial by comparison with that, but the general principle holds.
Probably a single app, or a few "single apps" for similar colleges. Texas has a single website for applying to all the public universities, and each application only requires the information you didn't supply in the previous applications.

https://www.applytexas.org/
> have you never heard the phrase "pay peanuts, get monkeys"?

No. I'm familiar with the idiom of "peanuts" meaning little money, monkeys have never been mentioned. In the modern American cultural context, monkeys are associated with bananas. Peanuts are associated with elephants.

> Have you not heard of webmonkey.com which uses the very slightly derogatory term in a self-deprecating way?

I don't care what people call themselves, nor do I care what members of a community call one another in jest. I care what people call others as an insult.
Chrome/Firefox aren't checking CA revocation lists
Chrome isn't checking revocation lists anymore (source: https://www.imperialviolet.org/2012/02/05/crlsets.html) so for everyone reissuing keys today, their sites are still vulnerable for Chrome users, right?

I checked Google's own (custom) CRL and they don't have any serials from Comodo or Verisign's revocation lists, but they do have some from GoDaddy. Verified with https://github.com/agl/crlset-tools.

Update: Added Firefox to title based on mbrubeck's findings.
This is probably one of my favourite HN posts of 2014. Outstanding.
This is a mixed bag, but I'd bet your router's running an older version than 1.0.1.
Heck, it also gets rid of the white on black, thanks.
It's just a move covert intelligent gathering approach of using a vaccination program to obtain DNA samples of the local populace. It's exercise for the reader to work out when technique was apparently used.

Certain groups that the US deems contrary to their national interests may come to an aid agency for help.
This is exactly what I did for grad school. I applied to an even distribution of schools across rankings, except at the top, where I applied to as many as I could. If you know anyone who got into a "top" school, you will also know they were rejected from many schools ranked much lower. It's just a guessing game at the top.
> namely, just contract on the inner indices. That is, arr(n1, ..., nk, m) @ arr(m, p1, ... pl) = arr(n1, ..., nk, p1, ..., pl).

No. This is what a mathematician might assume the PEP proposes without actually reading it. It instead proposes an entirely non-obvious definition which not equivalent to what you wrote.

In particular consider this example from the PEP.

arr(10, 2, 3) @ arr(10, 3, 4) = arr(10, 2, 4)
There is very little self-signed https traffic out there because browsers have chosen to treat it as somehow less secure than unencrypted http. (I do realise it's rather problematic to mess with the security expectations of https at this point, but you could imagine an http variant that allows encryption without authentication, without giving dire warnings to users.)

If all http traffic instead used self-signed https, then the NSA assuredly would not have the resources to MITM all of it. So because of the reflexive "self-signed certificates are worse than no encryption!" dogma, we have an Internet where most traffic is unencrypted and therefore trivial for governments and criminals to intercept.

Regarding certificate warnings: even if self-signed certificates were accepted, browsers could still put up a warning if the certificate changes between visits, similar to ssh's treatment of host keys (being relatively unsuspicious of unknown hosts, but putting up a big fat warning if the host key has changed).
Etsy Security Update: OpenSSL Heartbleed
April 8th, the day we learned that nknighthb doesn't know he's a racist.
I don't really understand the hype over this product.

This type of thing is already well established in the healthcare sector, see e.g. https://www.evidence.nhs.uk/formulary/bnf/current/a2-borderl..., with the added benefit that such products are formulated by nutrition scientists who actually know what they're doing, and run proper clinical trials to test.
Farts.Sexy
Docker and Cloud Foundry
Funny enough, I put a lot of work into a OpenWRT dyndns update script. I wonder what ever happened to that code.
It is really difficult to refactor such things at the public API layer once they are widely adopted by 3rd party projects.

Take the aforementioned error return inconsistencies -- how do you possibly deal with refactoring that for consistency when so many other projects are consuming OpenSSL as a library? You're trading one big problem (new clients are likely to get error return handling wrong) with another (if you modify all the returns for consistency, existing clients are now expecting the wrong return codes or, if you're smart and rename the functions to avoid that, at the very least the 3rd party consumers now need to do a lot of rewriting and deal with a painful crossover phase supporting both the old and new APIs).
The line between whitehat pentester and blackhat cracker is very thin, of course. They use the same tools and the same techniques; the differentiating component is intent and target.

The title of your post is "Using Heartbleed PoC for Hijacking User Sessions En Masse". Not "Your users' sessions are at risk", or "Heartbleed affects more than private keys". The express intent of the published code is the theft of user sessions. I know that you probably don't have any intent to do Bad Things with it, but if I was a prosecutor looking for someone to slap around with the CFAA, you just threw up a giant neon "SUP BITCHES" sign.

The folks you mentioned all produce tools which are intended and marketed for use by white-hat security professionals in the pre-emptive exploitation of their own networks for the purposes of security. Yes, we all know that the Bad Guys use Metasploit extensively to find and exploit machines, but if Rapid7 were positioning their tool as the premiere solution for pwnz3ring b0x3n, you don't think they'd be in a legally different situation?

I never said you were wrong. In fact, my exact words were "I wouldn't convict you" - I really do get why you published this, and I don't think you're some bad guy cackling to yourself from deep within your evil lair or anything. However, we know from recent history that things less gray have (unjustly, IMO) in fact landed people in prison. It's not illegal to own a crowbar or lockpicking set, but it's illegal to own one with the intent to commit burglary. Intent matters, and they way you positioned your PoC is problematic in that its stated intent is "mass hijacking", rather than "demonstration of an additional security problem". I am not trying to say that there's anything wrong with the code you've published - there isn't - but that the way you've presented it is potentially problematic if it were to attract the wrong kind of attention. That's all.
Sort of. But it drives me crazy that WhatsApp was bought for like 5x as much.
If each of those where equally used, and same with different key handling system, security by diversity would help. For example, the gnutls vulnerability only effected x509 resolving of the certificate chain, so those handful of people who use the pgp model were not effected.

Sadly, even if those options are available, gnutls is not common on the web, and https with pgp is even less common. Worse, some propose that we should use such options less in favor of one and only one library in the name of security.
This title is disingenuous. He donated to a candidate, and responded with the following statement in less then 24 hours.

"decade ago, I made a contribution to Representative Chris Cannon because he was the ranking Republican on the House subcommittee that oversaw the Internet and Intellectual Property, matters important to my business and our industry. I accept responsibility for not knowing where he stood on gay rights in particular; I unequivocally support marriage equality and I would not make that contribution again today. However, a contribution made to a candidate with views on hundreds of issues has no equivalence to a contribution supporting Prop. 8, a single issue that has no purpose other than to affirmatively prohibit gay marriage, which I believe is a basic civil right."
Collaborative 3D scene builder in 50 lines of code
my ASUS router uses the 1.0.0 branch so it shouldn't be vulnerable to this bug
I'm in that course! What's interesting is comparing it to the Stanford AI course from a few years ago. The professors have very different approaches.
Meteor (YC S11) is Hiring
The final soylent formula tastes incredible. We are in the process of having medical research firm conducting formal tests on the precise effects soylent has on people during real world use. Regardless, soylent is safe for consumption now as certified by our manufacturer and the FDA.
Without commenting on the overall debate, I think this nails the issue with the article:

> However, a contribution made to a candidate with views on hundreds of issues has no equivalence to a contribution supporting Prop. 8, a single issue that has no purpose other than to affirmatively prohibit gay marriage, which I believe is a basic civil right.
Yay! More witch hunting.

/s
drag racing for pinks
lets create a big internet shitstorm and make him resign. sad case about what happened to the Mozilla ex-CEO.
Let me see if I understand. So I'm suppose to wait on a corner and hope an investor does a drive by of my idea? Thanks, but no thanks. I think I'll stay home (East Bay) and code.
If there's alternatives then why do so many pieces of software (nginx, Apache, etc.) use OpenSSL as opposed one of these alternatives?
It's because you sound like the "check your privilege" crew that tends to congregate on Tumblr. (http://knowyourmeme.com/memes/check-your-privilege)

By the way, the key line from the article you didn't read (yet presume to understand its author's intent): "I have come to the conclusion that OpenSSL is equivalent to monkeys throwing feces at the wall."
Wow this is so cool!