skysight-inc/HackerNews huggingface dataset:
What I was trying to convey is that if you say "I'll just implement a better freelist" you're really just fooling yourself. What you are doing is re-implementing most of malloc on top of malloc, poorly.

If would have been better if they had gone whole-hog with a malloc library and built it from the ground up for their specific purposes instead of half-assed "freelist speedhacks."
Yeah, assurance contracts make the "figuring out what to fund" easier, since there's sort of a natural selection process. You still have execution risk, though, which is probably the biggest problem right now: if I'm contributing to fund the creation of some software, how do I know the funded people will actually deliver?

That's where a trusted intermediary probably has to come into play. The best thing I can think of at the moment is a version of Kickstarter that vets the candidate projects almost as thoroughly as a VC would and takes a cut for providing that service. Not sure how the business economics would play out in practice, though.
Ideology is the most important reason to choose open source and free software -- the ability to inspect and learn from the code is paramount, regardless of whether the software is superior or inferior to some other closed product.
I think it would be interesting to make the guide interactive, provide better pictures and details and taylor it to tech people- make it almost like an API reference.
I have a twitter account which uses my 'real' name spelling purely for the purposes of squatting on the name.
Superior medical systems != superior medical research

When you talk about sustainable plans here, it's all about relative stability. Sure the DOD might not be a completely sustainable way to fund this research, but I would certainly vote to turn it back on given the alternative being zero funding. You could make the argument that something like the Gates Foundation might be better, but I don't think it's obviously better in all areas than the DOD.
US receives 172,000 H1B visa applications, lottery decides fate
Thanks! Currently using MEAN. The notifications use websockets for real-time updates, but eventually I'm planning on extending that to the feed and other areas.
Let's gather 10,000 Ruby on Rails learning stories
First, tumblr? Really?

Second:

"When Federal agencies discover a new vulnerability in commercial and open source software – a so-called “Zero day” vulnerability because the developers of the vulnerable software have had zero days to fix it – it is in the national interest to responsibly disclose the vulnerability rather than to hold it for an investigative or intelligence purpose."

This is demonstrably false. That's not even a point of debate, by their own admission.

The whole statement is worthless.
Their statement would carry much more weight if they could point to one example of an exploitable zero-day they've actually disclosed.

I don't particularly trust the NSA, but this example probably exists.
How is he going to live in the US without the Green Card?
Clapper couldn't divulge the existence of a classified program in an open session hearing. If they really wanted answers vs. trying to grill the NSA in a public forum they could have asked the question in a closed session with only participants who've met the proper clearance level for said program disclosures.

Unfortunately on HN anything NSA related is going to devolve into conspiracy theory groupthink these days vs. actual rational discussion that the NSA is not all knowing (unlike every other government agency which is apparently incompetent).
Should be possible to convince them with "Hacker makes incriminating but false post on your Facebook" -> "Employer checks your Facebook" -> "Employer shows you the door."

"Why would anybody do that?" For the lulz ("random acts of malice"), sadly.
They also may use lasers to trim and tune the mostly-crystal oscillators used in timing circuits, such as the small quartz "tuning fork" found in many digital watches.

http://en.wikipedia.org/wiki/File:Inside_QuartzCrystal-Tunin...
I love the abundance of Python. For those unaware, even the youtube-dl command line utility he used to download the video is written in Python.
My favorite personal work music is phutureprimitive https://soundcloud.com/phutureprimitive/sets/kinetik
No, it's only derivative in the sense of process. The video lacks originality; for the musical notes it is merely a mechanical reproduction of the punched holes. Similarly, a photograph of a public domain painting is also in the public domain. See: Bridgeman Art Library v. Corel Corp., 36 F. Supp. 2d 191 (S.D.N.Y. 1999). At least this is the law in the United States, which is sensible; absurdity of other jurisdictions may vary.
Why do they feel a need to make a post about this if they are already honored by her joining?
Reworded slightly: "Evil is evil. You can't change it. Get over it." I don't buy it.
It appears the answer to the first question is yes:
http://www.odni.gov/index.php/carousel-items/916-the-intelli...

As for the second question, yes, it does seem strange.
It would be good to hear other HN:ers experience with various static analysis tools for C.

I have had good experiences with Flexelint (PC-Lint). It does not attempt to deeply analyze control flow, more like compiler additional warnings. It flags a lot of common mistakes and can basically turn C into a more strictly typed language. I feel a lot more confident in C code if I know that it passes lint, since it warns if you try to mix unsigned and signed ints, cast away const, call functions with wrong types etc.

Like many static analyzers it takes some work to set it up, and tune which warnings you actually car about. It is definitely business-priced and feel a bit old (although command line tools age well.

The is a clear lack of good open source tools. I tried all i could find, but Splint was the only one that would flag switch-cases without break. It was last updated in 2010.
You're asking like it's the first time an open source project was sponsored by large corporations. Let's see, what's in it for google just in terms of PR? Developers it can attract? Ways it can get webmaster mindshare?
I hesitated posting this because I do not want to give the impression that OpenBSD is not worthy of donations. That being said I am not sure that it is useful to present Mozilla's entire annual revenue as it is all for Firefox. Mozilla does a lot more than just Firefox.
I mostly thinking you'd go to big companies with something at the $100k/year level for membership - including some influence in project direction, code review methods, audits, features etc.

Selling something online, could work but the question is what do they get for their money? a t-shirt, name on website etc. Though in a world of kickstarter it could work if done right. This is a $50/yr deal for most which is 20k people to get to that same $100k with a lot more community work to keep up with those people.
Is it not possible that what you describe as a two-way parasitic relationship is in fact one of symbiosis?
To expand on the DES example, the S-boxes are essentially large 'random' lookup tables. The NSA took the S-boxes, and replaced them with their own tables. At the time, it was not clear if this was to protect against an unknown attack, or to introduce an unknown attack (which may involve knowing some secret key used to generate the S-boxes).
Heartbleed only leaks SSL-related memory - not program memory!
You should talk to my friend who's doing Wallrent here in Toronto: http://wallrent.com

his email: richardsondx [at] gmail.com
http://www.odni.gov/index.php/carousel-items/916-the-intelli...
So go work on OpenSSL. Oh wait.
I don't have to assume.

In this case I can sample. Now, my sample size isn't very large, in fact it's just one person... me.

I had a free account and I closed it. I doubt they care.

But don't you think you are taking a comment made largely in jest just a bit too seriously?
The Google Play Store is a nightmare for smaller developers. Unlike every other app platform I can think of (including Amazon's) which just send you nice tidy royalty payments, Google expects you to handle the sales tax for each and every customer, everywhere in the world.

And yet virtually nobody talks about this. I'm quite certain that any developer without an accountant is either getting it wrong or ignoring it completely. This is the reason that if I release a game for Android, it will only be through Amazon.
you helped by clarifying :)
I haven't seen this mentined in this thread yet, so I just want to remind everyone of the Suxnet virus that contained four 0day vulnerabilities and was in active deployment from anywhere between two to five years. If you believe that they were the originators of this virus then this directly contradicts the claim that 0days are responsibly disclosed in a timely manner.
This book goes into quite some detail about how our tax code and it's frequent changes, or threats to do so, are a finely tuned instrument of Extortion: How Politicians Extract Your Money, Buy Votes, and Line Their Own Pockets http://www.amazon.com/Extortion-Politicians-Extract-Money-Po...

Quite a bit more, as well. Did you know that a Congresscritter can set up a "leadership PAC", and spend the money on anything he wants? I've been following this sort of thing since the early '70s (sic, late grade school and junior high, then again that was the Watergate period), but I didn't know that....
First of all, if at all possible, don't fire someone in an email. Second, I'm not a particularly blunt person, but I'm not sure the sandwich approach works here. It's great if you have the opportunity to help the person being let go find new employment. However, it's important to ensure the person is clear that it's not working out and there's no room for negotiation. (And there shouldn't be by the time you've made the decision to fire someone.)
I like Frama-C a lot in theory, though in practice I found it hard to use except on very small code segments.

When its unable to prove a range the feedback you get from the solvers is inscrutable enough that its very hard to figure out what additional data it would need to satisfy the analysis. (Sort of like parsing C++ compiler template related errors)

I'd hoped that language features like the typestate stuff that used to be in Rust would someday make the work required to use sound analysis tools in production code smaller. I'm not sure if much thought has been given to what kinds of accommodations languages could give to ease static analysis while still being programmer friendly.

It seems that newer languages have actually moved away from analysis friendliness in some respects, however. E.g. in C a signed overflow is always a bug so if analysis can prove one is possible you have something to fix. Several modern languages have defined signed operations to wrap and so that obvious safety test is no longer available. (You could define in your own code that it should never wrap, effectively writing in a subset of the language, but as soon as you call into third party code you never know if an overflow was intended and safe or not— not without extensive analysis)
You don't need a CHL to have a firearm with you while traveling in Texas.

Wikipedia explains it well: "Gov. Perry also signed H.B. 1815 after passage by the 2007 Legislature, a bill that allows any Texas resident to carry a concealed handgun in the resident's motor vehicle without a CHL or other permit.

The bill revised Chapter 46, Section 2 of the Penal Code to state that it is in fact not "Unlawful Carry of a Weapon", as defined by the statute, for a person to carry a handgun while in a motor vehicle they own or control, or to carry while heading directly from the person's home to that car.

However, lawful carry while in a vehicle requires these three critical qualifiers:
(1) the weapon must not be in plain sight (in Texas law, "plain sight" and "concealed" are mutually exclusive opposing terms);
(2) the carrier cannot be involved in criminal activities, other than Class C traffic misdemeanors; and
(3) the carrier cannot be a member of a criminal gang."
This is inflammatory and vapid. OpenSSL just needs better code review and should follow the standards they are programming to. It's not the death knell for an entire programming language.
LinkedIn Expands Its Presence Within China with a Startup Approach.
> I love that it imposes a discipline that prevents me from using that flexibility in stupid ways.

What discipline? Am I missing something?

> maybe we have to move away from C.

Hopefully, Rust will facilitate this transfer.
I have to admit I am very surprised Amazon hasn't bought out Canonical in order to inherit a large install base and build their own ecosystem.
The problem is that no other language has captured the good points of C anywhere near as good as C. There are ways of using C that are much less likely to result in this type of bug - and the more complex processing that other popular languages can add in surprising places can cause bugs too. I've been meaning to learn ATS that basically adds a separate validation layer to C:
http://www.ats-lang.org/
It is posts like this that make me think twice about reading the comments on NSA stories. For starters how many intelligence agencies publicize their successes? Do you think other four eyes purchase full page ads detailing the highlights of successful intelligence operations?

Anyway lets skip the banal "intelligence agencies failures are public and the successes are private" and get to actual examples:

DES SBoxes

SELinux

NSA Academic Centers of Excellence

VENONA
Driving around at 20mph sounds barely worth it. There has to be a better solution.
... not until something else with a sane, stable ABI that everyone agrees upon comes along (and before anyone points it out, I realize C has no actual standard defined ABI, but it doesn't matter in practice because following the OS/arch ABI is always the path of least resistance when linking C).

For all of its issues, C is still incredibly important for being the only language you can fairly easily integrate with virtually any other language.
True, though hopefully it will make people thing that, no matter how smart the programmers working on a project of a similar caliber are, there will be, for the most part, vulnerabilities like this caused by using C.
Overreaction. With enough eyes all bugs are shallow. Look at Linux and BSD vs BeOS or something.

If you want safe operations in C, just write a few simple functions and use those.
Was this comment ironic? Can you back up your claim, "Joel Spolsky has absolutely no idea what he's talking about," with some evidence?
Time Loop Logic
If they're not lying, that's arguably worse!
This has nothing to do with the language and everything to do with the programmers and practices - some great write-ups:

http://www.tedunangst.com/flak/post/analysis-of-openssl-free...

Who can resist Theo: http://article.gmane.org/gmane.os.openbsd.misc/211963
Michael Lewis hits back
What do you mean? They're still here -- they're called "Hungarians." :)
Wikipedia says they were probably a fantasy and really just above-average skull size humans similar to what we find today. I wonder if they were found in groups which would suggest they were consistently different, or just randomly appearing among normal-skull people as the final paragraph seems to say (but tries not to).
this might not necessarily be a good thing.
see: http://en.wikipedia.org/wiki/Motivation_crowding_theory
I can go to all 6 top quantum random number sites. They don't have proof for people who are not in the room.
While it has its good points, Go lacks the performance and memory footprint of C programs in constrained environments, or at the system level.
I don't think we really need Ed's disclosures to tell us anything they say is utter bullshit.
Or we could have better code review and donate to OpenSSL so they have more motivation.
How To Stop Losing Money On Social Media – Proven System and Case Studies
Gotta love brent.
C#/.NET Graphics framework
vulnerabilities were not caused by using C, they were caused by human error. C may be harder to read, but it is way faster than most of the alternatives.
Or monetize it via ads.
There's a small set of systems code for which C is a requirement, for various reasons. (There are experimental systems trying to get non-C languages into those areas too, and more power to them.)

But today, writing large piles of new C code interacting with untrusted users and data is both painful and irresponsible. Pick a higher-level language, any higher-level language.

As far as I can tell, the main thing keeping C in its entrenched position these days isn't performance, or preference; it's C's status as the language of the native platform, that every other decently powerful language can talk to via FFI. If you write a new library in language $FOO, it'll mostly get used by other code in $FOO; if you write a new library in C, many different languages can use it.

However, adhering to the C ABI does not require writing code in C. And if enough new libraries start providing a C interface backed by a more powerful language, perhaps we can start establishing careful extensions to the C ABI to better fit higher-level languages (such as standard ways to pass buffers).

That's not to say there aren't new classes of systemic bugs in other languages, too. And FFI code, by necessity, lets you write C-like bugs. However, there's no excuse for buffer overflows and integer overflows anymore when any decent high-level language has buffer types and bignums.
Not a lot of content in this post. Not to mention that either everything in it has either been said before, or completely exaggerated.
Oh -- that video was part of Googles response? I thought it was part some meme to describe Googles response.
not really. use koa instead if you can. a lot of middleware hasn't been written for koa yet, so you might have to write your own.
The Horrible State of Reviews in the Windows Phone App Store
Actually, to be more accurate, it's a victory for due process and Great Justice.
> http://www.openssl.org/support/acknowledgments.html

And they're not selling Qualys on future contributions. They got their logo there, and it seems like it'll stay there forever. They are a "Past Contributor", and they get what could be prime corporate advertising space to security engineers for free every year they don't contribute. I can't tell if they're a current contributor, or how much it would cost to put $MY_COMPANY logo there. And I don't know why I would care, because it appears OpenSSL doesn't seem to care about who is paying year-to-year.

It says "Past or Current". That should just say "Current". Anyone who isn't a current contributor should get their name taken off. Also, where is Google? Apple? Microsoft? IBM? Oracle? Juniper? None of those names have logos up there. That should be fixed. Has anyone ever cold-called those companies and asked to talk to their sponsorship and corporate contributions groups?
It would be nice to pull the plug; color me skeptical it will ever happen, though.
That particular human error would have been impossible if using another popular language (other than perhaps C++).
That the Bloomberg report resulted in a denial so quickly demonstrates the defensive position of US intelligence services today.

Strong suspicion that the a federal agency would withhold vital info about Heartbleed is a direct result of the shocking revelations of mass-surveillance.

I believe the sentiment expressed around this issue is not entirely contained to Heartbleed.

This is about distrust of the federal government to make good administrative decisions around highly technical issues that affect the public. Keep in mind Kathleen Sebelius just resigned largely due to optics around IT management failures.

Widespread distrust of federal organizations ability to manage technology appropriately will only erode faith in federal government as a whole. That's not a good problem to have.
It's nice to know our system accounts for cases like this. Thanks for the detailed info!
I love Go, but it is a prime example of a language that fails on the problem C solves that nothing else does that I mentioned in another post on this thread...

Getting Go to link to anything but C (and C++, but only if it uses C interfaces) is (depending upon the specifics of the other language) difficult to nearly impossible (and at some point certainly involves using C anyway).
I think bad programmers should be retired, not the language
That doesn't give me, as a user, much comfort. But I can see your point from a corporate standpoint.

This whole things just sucks.
Please use caution when interpreting preclinical drug results. Yes, Tekmira saw great efficacy in non-human primates, but that doesn't necessarily translate into human efficacy.
Tekmira focuses on RNAi therapeutics (a field in which I spent time on the research side in industry). Many RNAi companies have fallen from grace in recent years due to liver toxicity associated with lipid nanoparticle (LNP) siRNA delivery vehicles. Tekmira was a pioneer in lipid delivery, and they use an LNP vehicle in their TKM-Ebola therapy.
I'm sure the siRNA they use is wonderful, with great knockdown and durability, but in this space it is the delivery vehicle forming the bottleneck.
Disclaimers aside, Tekmira initiated a PhI trial of Ebola-TKM this past January and it will be interesting to see how the toxicity plays out.
I can't wait to try this out! Pop music can be energetic, but it can also be very distracting. In the past, electronic music has been my go-to, but lately I've tired of it.
Myself and a friend are working on a code visualization tool in the spirit of the original Code Bubbles (https://news.ycombinator.com/item?id=1181742)

It's called Code Connect (http://codeconnect.io) and you can see our prototype demo at: https://www.youtube.com/watch?v=CuQ8NJOypqs

We're currently working on Visual Studio, but I'd like feedback on other IDEs and editors you guys think would be extensible in a similar manner. Would this behavior even be possible to accomplish in Eclipse, IntelliJ, SublimeText, Atom.io, etc?

We're also looking for beta testers and people interested in giving us feedback on the idea. You can subscribe for updates on our beta's release at http://codeconnect.io or reach out to me directly via josh@codeconnect.io or on twitter at http://twitter.com/GetCodeConnect
connect is basically just a `.use()` kernel, and express' router was just mounted on this kernal. now, express' kernel combines connect's `.use()` kernel as well as the router, simplifying the entire middleware system internally and removing the need to do `app.use(app.router)`.

i.e. you're no longer mounting the router on top of another kernel.
They'd have no problem getting US students if they paid more.
I agree! I don't think anything will change until doing such crimes results in jail.
Thank you for the comment. The good news is I feel the same way about the CLI and the video. The video is temporary as we work towards a proper launch. For now there's a few dozen guinea pigs helping us polish the functionality. The CLI will take a little longer as our small three-man team is stretched a bit. Maybe in a few months.

Also agree about the theming. The nice part at least is that theming in theory is very easy. Themes are just git repos that are downloaded and installed through the browser and unpacked via a websocket. I think you're right though that we need a few solid, well-designed themes there in the beginning though. It'll likely be my primary concern over the next month now that the product is finishing up. Although opening a store might be a good way to go, I'm thinking we'll likely just try and partner with one of the many buy-a-theme sites out there and simply let them continue serving that niche.

Part of the fun of startups though. Trying to octopus your way through a launch, building every little bit.

Again, thanks for the comment.