skysight-inc/HackerNews huggingface dataset:
not sure what you have to maintain, but it sure sucks having to scramble and fix this right away.

our (quick) fixes are almost all done:

- recompile openssl where necessary (web, chat, mail, windows binaries) without heartbeat support

- roll related certs and keys ASAP

and then comes the painful process of suggesting all web service users roll their certs and auth.

oh, and rotate personal passwords at other sites that issue a warning about openssl...
Stradivarius violins lose in blind test against new ones
Because if you write that in C#, you have to bundle 54MB common runtime and GC withit.
I am saying that the benefits of porting a codebase that has had so many security vulnerabilities doesn't outweigh the cost of reimplementation.

Reimplementing a secure SSL implementation in a secure language is cheaper than porting the broken code.
I actually had Fortran-77 between Pascal and C. C, compared to Pascal, was like taking off the handcuffs.
The Appcoin that google brings up seems to be unrelated to assemblymade.com. e.g. https://bitcointalk.org/index.php?topic=475160.0 , so who knows how "app coins" from assemblymade actually work. I would guess it isn't a decentralised cryptocurrency, just a token to be used on the site.
To factor out identifying pops & scratches, pre-record a vinyl song onto digital...

This would simply be a digital reproduction of a vinyl recording. (Something I quite like BTW). Vinyl is a "thing" because the process plays a part in creating that sound people love and not just reproducing it.
I don't think it's inappropriate language, but I find your statement that the Queen can suspend Canadian parliament any time she wants is totally incorrect. The case you link to is an exceptional one that had no jurisprudence, and was most likely decided by the Queen's representative, not the Queen herself, which is not an insignificant difference. This was the aftermath of an election with a minority government result, which almost never happens in our First Past the Post system. Your misrepresentation of this case is more offensive to my eyes than your language. My HN values intellectual correctness over proper language. :)
Even if I don't agree with all of this, it's at least a good explanation of why I find "marriage equality" distastefully propagandistic. If people waving that banner truly wanted "marriage equality" they would be fighting for normalizing marriage laws across the whole nation (marriage age and other requirements like relatedness as you mentioned), polygamy, etc. If they wanted to extend the logistical benefits of marriage (tax breaks etc.) to more people, they could fight for marriage between people that were doing it purely for the legal benefits.

Just call it "fighting for same-sex marriage", because that's what it's mostly about. "Marriage equality" feels like trying to sway the listener by giving a deceptively broad impression of the aims of the movement.
I think you get most of the benefit of diversification with as few as 8 stocks [0], so if you kept each of the pools small you could avoid a lot of the scaling issues.

[0] http://en.wikipedia.org/wiki/Diversification_(finance)
I don't think I've ever met anyone, ever, who said they liked forums.

Hacker News is a forum.
I feel the same way. If I were designing my own iPhone, it'd be as light and thin as the current-gen iPod touch, but with the height (and so screen size) of the iPhone 4 series.
Daft Punk Lego Minifig raytraced in your browser.
I found this video of security researchers publicly announcing the existence of the heartbleed bug: https://www.youtube.com/watch?v=7CkTYPnJS0E&list=PL0ECC73C46...
I don’t; but I do not know how I could ever be sure. I’m a generalist sys admin and my knowledge of crypto is limited to the basics. That being said my understanding is that this vulnerability is in the code that creates the sessions not in the certificates themselves. The risk is that my key already was compromised when I was using the vulnerable version. For me this means two things:

1) There is no easy way for me to confirm or deny the CA is fixed short of attempting to exploit them.

2) Even if the CA is not fixed the vulnerability appears to in the routines used for session management not in the SSL certificate itself. While there is cc information and other stuff I would not like to be leaked, the CSR itself only contains my public key not my private key. As long as my servers are patched and I have a SSL cert using a new keypair that I know has not being compromised; I am not sure if the CA's version of openssl maters or not.

I am in no way trying to pretend I am an expert. I am sure there are problems with my analysis but it still feels like its time to be pragmatic and get a fix in place before asking all the what-ifs. Not that those questions should not be asked but it’s a mater of prioritizing.
I don't have a reference, but I've seen this myself. Problems can happen whenever pointers combined with the STL or other modern C++ stuff. In the thread from several years ago, I gave as an example pushing a pointer to a local variable into a vector which is then returned somewhere outside of scope. Compilers don't warn about this, or at least didn't then, although Valgrind catches it. And of course this can be a more complicated case, like a vector of maps from strings to structures containing pointers which is passed by reference somewhere - which will make it harder to catch. And Valgrind won't help if it doesn't see it happening in the execution path that you ran.

Now, combining pointers and STL is not a good idea. In fact, using raw pointers in C++ is not a good idea, at least IMO (but you've seen I am a bit concerned about memory safety). However, this is perfectly supported by compilers, and not even seriously discouraged (some guides tell you to be careful out there). I've seen difficult bugs produced by this, in my case, in a complicated singleton object.
That book is fantastic, rates very highly on my list of excellent histories of computing.
Test your server for the Heartbleed bug
Tell HN: Ubuntu already updated openssl packages
If you're on Ubuntu, you can simply run an update to patch the bug:

sudo apt-get update
sudo apt-get upgrade

Thanks Ubuntu!
Isn't this pretty much how all loans are presented in the USA?
Is `educated worker` some kind of euphemism for genius/top of the game or something? I am an educated worker, and probably everyone else around here.. Seems like a bit-too-broad statement(I for one am not currently interested in immigrating not one bit)

Anyway, I always thought the best would want to move to the US because it's there's top work, e.g.: there's no Tesla or SpaceX elsewhere and a top engineer would probably want to be doing this kind of work... Same with scientists that are working on ambitious research. But maybe I'm thinking about H1b as more of `top of the top, get your asses here` and it's more like `ye you're skilled enough you can try`, dunno.
Using C as an output language, backed by guarantees at the higher level, could certainly work. I believe ATS [1] works this way, and can even avoid garbage collection altogether if desired. I understand it is not an easy language, though.

Nimrod [2] also generates C, but as I understand it garbage collection is unavoidable.

[1] http://www.ats-lang.org/

[2] http://nimrod-lang.org/
Yes for normal companies this is fine, but for VC companies? How long do VCs let companies slog along before the pull the pin? It would seem not that often.
Only person I need to meet expectations of is me and not of anyone else.

Time is more valuable than money and things. It can't be regained.

Value experiences over things. Experiences last a lifetime, things don't.
For those interested, here is a direct link HN user josh-rale had posted in the other popular thread:

http://people.canonical.com/~ubuntu-security/cve/2014/CVE-20...
> As such the rules that govern how markets operate can be changed to serve humans. This is very easy to understand, wouldn't you agree?

I agree with this.

> Now comes the question: does HFT serve humans? Some people say yes, others say no.

I would say that the "others" in this statement are incorrect (except in some isolated and relatively unusual circumstances). Since upthread you said "Technically their arguments are quite good." I had assumed that you agreed with me here, but perhaps not?

> but they also reduce liquidity during crises (bad).

They don't "reduct liquidity during crises." They might provide less liquidity during a crisis than they do at other times, but that's not the same thing.
This is a silly and hypocritical critique. All countries have their flaws, but you're really not being fair or objective.

You lambast Japan for a lack of government transparency just as you finish extolling the virtues of Hong Kong and Singapore. You also conveniently fail to mention the salary required to live "like a king" in either of those two locations. Singapore ain't cheap. In fact, it's the world's most expensive city by several measures [1].

H1-B is pretty broad, and most applicants are certainly not eligible for mid six figure salaries in the finance hubs of Asia. "Highly qualified" for the purposes of this discussion does _not_ necessarily mean rolling in the dough.

Lastly and most comically : Canada's parliament being desolved by the Queen? That's patently absurd.

[1] http://www.bbc.com/news/business-26412821
Full Disclosure: I submitted a different scene over the weekend (Saturday) that wasn't as interactive as well as this one. Figured I'd try my luck again on a different day/different time/different scene.
A one-time link sharing system (Working Prototype)
Seems relevant: "App-pocalypse Now" by Jeff Atwood http://blog.codinghorror.com/app-pocalypse-now/
And yet, despite millions (I'm being nice, probably billions) of lines of VB6 code, not one single competitor has managed to build a business out of creating a 100% Visual Basic 6 compatible system.

Looks like Microsoft was correct in their assessment of shooting VB6. Nobody using it was willing to pay money.
>Additionally, although the parsing portions of OpenSSL need not deal with the hardware directly, the crypto portions do. So your memory-safe language needs some first-class escape hatch to unsafe code. A few of them do have this, others not so much.

For the other points there is some debate, but don't most serious languages have a C FFI?
To me it's the universities and the already existing multi-culturalism. Everyone here is an immigrant in some way.

Also, multi-culturalism seems to be growing organically here in the U.S rather than being shoved down people's throats like in Europe. This leads to fewer instances of racism and a more accepting climate where every one has some degree of mutual respect. I don't think that's the case in Western Europe where from what I hear, refugees are being brought in huge numbers angering the local population.

Last year, i visited Switzerland and Austria and was called nigger multiple times by random passers on bicycles whilst walking (and I'm not even black and pretty fair for an Indian guy). Fuck that shit.
I am in USA on H1B.

A lot of American problems seem to be around the thinking that there is some kind "fixed" number of jobs, misery, poverty, disease etc.

A lot of welfare systems here seems to assume that there is a fixed number of single mothers, disabled etc. without acknowledging the fact that the more incentives you give to them more people will try to get into that category. For example more dole you give to disabled I would assume more people would try to get themselves into disabled bucket than in healthy.

Similarly the H1B cap seems to have an assumption that there are some fixed number of STEM jobs out there and if Indians fill it up, somehow the Americans will not get it. I would assume a higher concentration of Engineers in USA would only lead to more innovation, more engineers trying to earn more money by being far more creative and so on.

In India a typical outsourcing giant pays somewhere between $5K to $10k per year to new engineers. The only way I could break such low pay was by getting a master degree, being an excellent coder and joining a more tech focused company in Silicon Valley. After reaching Silicon Valley I realized the tech giant I was working for did not pay me enough. So I changed the job and joined a start-up which eventually did far well making me richer.

Also the Democrats which beat their chest in the name of poor are actually those who treat poor the way a Dog treats a lampost. The lampost helps the Dog navigates but only after it is soaked in his pee.

More engineers would mean cheaper engineering services which means more money saved for rest of the non-engineering Americans which a overwhelmingly high population. By putting an artificial cap on H1B American government is forcing the poor American citizens shell out more money.
They might "want to know" as little as possible, but they know the exact address of each user, and they definitely know the law in major American urban markets. They can't play dumb in an American court and say "oh I didn't know it was illegal for my residential hosts to rent rooms in SF and NYC!" Like, come on. Judges aren't dumb.
When I was younger, I loved hanging out on forums. There was perhaps a more robust community feeling, since forums can have multiple sections, and include off topic and chattier discussion without people complaining about being deluged with mail. Avatars and signatures let people express their personality and made it easy to tell the author of a post.

Then again, to some extent I'm just nostalgic. What then was personalization I might now see as a rather low post text (signal) to metadata (noise) ratio...
Wow, there are many ways to go with this...

I would claim that natural language is the most usable and the most powerful user interface. We humans have been relating with it for quite a while and there's no sign of a let-up.

And most programming language either contain fragments of natural natural language or can be translated into such fragments. Yet, the author is right, programming languages are "least usable". Indeed, consider SQL was created specifically to be usable like a natural language but it now considered more unusable than even an average programming language. What gives? (I have my suspicions but I wonder what people think).
The same company that has a press release that they do not wage collude:

"Not everybody took part in the no-hire agreement: last week, Facebook's Sheryl Sandberg said the social network rebuffed Google's approaches."

http://www.theregister.co.uk/2014/03/30/tech_giants_fail_to_...

Is the same guy pushing for visas to drive down wages:

"Fwd.us, a group founded in part by Facebook’s Mark Zuckerberg, has pushed for immigration reform. Joe Green, another Fwd.us founder, lambasted current law regarding the cap structure of high-skill visas in an email to TechCrunch, calling the current set of regulations “dysfunctional.” "

I guess being a prick knows no bounds.
Concur, one of the best JS learning sites I've found. He has a gift for explaining technical concepts well.
Focus on getting users and keeping them happy. Pass every decision through that filter. Right now is the only time in the potential timelines of your company where all goals and incentives are so neatly aligned (between users, employees, founders, and investors).

You don't need any complicated goal maintenance frameworks right now. You need to get users, keep them happy, and repeat. Otherwise, you will die. You will never reach the point where you have divergent goals between entities. So right now you have a simple goal, you don't need to think about setting others. It's a simple filter that facilitates all possible legitimate goals of a tiny startup.

If you have any short or medium term goals right now aside from getting users, keeping them happy, and acquiring more resources to fuel that positive feedback loop; why are you even doing a startup?
Google Chromecast finally comes to Canada
Fog Creek has frequently had co-ops; they just don't advertise it very much, for two reasons: they can't offer the same outings/bonding experience, and they can't take as many students at the same time. That said, if you're interested, apply. They've had some amazing co-ops over the years, and I promise they'll take your application seriously.
> This vulnerability is the result of yet another missing bound check. It wasn't discovered by Valgrind or some such tool, since it is not normally triggered - it needs to be triggered maliciously or by a testing protocol which is smart enough to look for it (a very difficult thing to do, as I explained on the original thread).

You could also look at this bug as an input sanitization failure. The author didn't consider what to do when the length field in the header is longer than what comes over the wire (even when writing the code in a secure language, this case should be handled somehow, maybe by logging or dropping the packet).
"If you don’t know where to begin here’s a good rule: only target colleges that admit less than 30% of applicants. That will give you a head start on being selective, especially if you have limited spots available in your program."

That doesn't really jive with the not caring "about which school you went to" bit. If that's the criteria it eliminates all but 2 of the top 25 public universities which is flat out ridiculous.
Oh, I understand the short-term capitalist incentive. It doesn't mean that it's right, legal, or in the company's long term interest. What if a class action lawsuit of hosts getting evicted hit them? I have trouble imagining on which grounds this would be successful, but then again IANA(class action)L.
Is this better (or notably different) than doing

sudo apt-get update
sudo apt-get dist-upgrade

?
You don't own your Kindle books, Amazon reminds customer
There were plenty of implicit rejections for me in the last two weeks. I decided to vent my frustration by learning how to write Android apps. Ultimately, it didn't do anything for me. But I did learn something new, and wrote something I think is quite cool.

In fact, I just wrote a new blog post talking about how I handled rejection and what I did to make me feel better

Then I rediscovered the joys of running. That made me feel a lot better.

TL;DR - Learn something new, and then do some exercises.
A good point, but not one I was trying to make.

My point was that if AirBnB did anything which limited itself to operating in legal areas, it would be several orders of magnitude smaller.
The Troubling Holes in Mt. Gox's Account of How It Lost $600 Million in Bitcoins
Is openssl in nginx statically linked by default? If so: ouch.
Yes. https://forums.aws.amazon.com/thread.jspa?threadID=149690
This. Now that there has been time for apps to be updated for iOS7 and the iPhone 5 size, the transition to variable sizes will be a much lower impact.

Also, it is clear that different sizes of phone will still use the 'iPhone' UI idiom, rather than the 'iPad' idiom.

Basically if you are paying attention to Cocoa, you'll know that they're ready.

(Speaking as someone who has a pixel perfect app in the store, popular for it's design, that is very painful to make flexible)
MPAA Suing Kim.com
Most leases include clauses about complying with applicable laws.
I spent a lot of time in high school on PHPBB systems. I find it less attractive now, using mostly IRC plus some forums, though I don't frequent them enough to be a "regular". I absolutely hate subreddits - I generally find specific enough ones to be of low quality compared to the equivalent forums.

I also absolutely love Futaba-style imageboards - it's a great blend of anonymity, simplicity, and community. It's a shame 4chan's reputation is what it is.
Why would I send sensitive data to an unknown website? Makes no sense. And if the data is too valuable, good reason to kill me and get a treat.
Please do note that Fog Creek provides an apartment to interns for exactly that reason. You would not being paying New York rent as a student.
I just wanted to point out that you really do not need the `apt-get clean.` Obviously your work flow is your business but I wanted to speak up in case you thought it was needed before upgrading packages.
A simple voting mechanism would work where you announce the shares you own to the pool you want to join.
I've built a web tester for this bug, find it at

http://filippo.io/Heartbleed/

It actually exploit the bug, since it was quite trivial, and echo some memory.

It's written in Go, no more than 100 lines. I'll release code in some time.
Lots of people are moving to Australia.

However, one big deterrent is proximity to the rest of the world. If you want to travel home to visit family, or due to an emergency - it's going to cost a lot of money and time.

Because of the distance, the logistics of physically moving there are also that much more difficult.

Then there are the mainstays - cost of living in/around major cities is quite high (though in the ICT sector earning potential is quite good), there are lots of scary critters, etc.
One of the best things I've read lately. Have we really just gained this communication freedom to use it to tell each other to stay in line and shut up?
Automatic typo corrector catches mistakes spellchecks miss. Beta signups
An unusual and piquant analysis of Internet debate culture.
when openssh uses certificates it still uses its own protocol (even with the x509 patch - without that, the certificates used by openssh are not even the same kind of certificate as those used by openssl).

the problem with the openssl library is in the implementation of the TLS protocol. this is not used by openssh. so openssh is not affected by this problem. even when certificates are used. and even when x509 certificates are used (which requires a separate patch).
Not really. To get sponsored by an employer you need a labour market opinion and there are certain conditions (like no Canadian candidates applying for said position during a certain time period).
Can I have copies of all the user submitted data? Probably full of bank account details, safe combos, etc.
They're demoing this at NAB this week; it's a pretty stale show, filled with legacy tech, so this was one of the more interesting highlights (actual exchange with a sales engineer: "what kind of APIs do you have?" "what's an API?"). The text is definitely written for broadcast professionals.
> What is that makes the United States such an attractive place to immigrate to for people whose skill sets could take them almost anywhere in the world?

Unrestricted Jus soli (http://en.wikipedia.org/wiki/Jus_soli#Unrestricted_jus_soli)
Her mid-1800s Italian has completely different characteristics from a 17th century Italian. A string player spends months or years trying many instruments before deciding on one. I've never known a professional musician who cares whether they're playing on a modern or an older instrument, they care whether they have the right instrument for them. You have no idea what you're talking about. Please just stop.
Very cool! Tested my site before and after a patch, and it recognized the fix. A quick UI tip: you should give some indicator while the test is running. I couldn't tell anything was happening while I waited. Even just a spinner gif of some kind.
While I'd love to see web replace native apps, I don't see that happening in the near future. With the kind of innovation happening in the mobile space (iBeacon, Android Wear, Background Fetch etc.) it's probably impossible for the web to keep up.

But there is certainly a bubble in the app space which will bust sooner or later. Not sure what will be the next big thing though. Web does not seem like a candidate.
dist-upgrade can perform unpredictably and can put your servers in a fubar state. Here's just a quick comparison of the two:

http://askubuntu.com/questions/194651/why-use-apt-get-upgrad...
I think that was part of his point, but yeah I don't see why you couldn't do the pure parts in a safer language. FFIs to C are fairly easy to do I think, probably partly because of how simple the calling convention is.