skysight-inc/HackerNews huggingface dataset:
Thanks! So how does this work: Say I have this project and I want
it audited -- would you (or the company/person that you
had in mind) give me an estimate like "I'd need 3 weeks for
25, 5 weeks for 50 or 10 weeks for 95% coverage" or do you simply analyse away for a week (or whatever time I'm willing to pay you) and try to find something?
It's kind of silly to point out that not all products lend themselves to any particular model, isn't that right?

I have the impression that would-be-creators are rushing towards specific advertising or pay-for-access models too quickly.
HBO Silicon Valley: Peter Gregory = Thiel or PG?
Is Peter Gregory supposed to be Peter Thiel or YC's PG?
JFBmarketing at APSense: James Rickards shares his views on The Death of Money
I recommend checking out Django, it's a great framework, also really easy to approach and learn. Their documentation is perfect!
trying amisaserver found it somewhere in the comments below. claims to have MVCC.
I was under the impression that they did in fact contact package maintainers in addition to companies like CloudFlare.
It allows people to setup a checkout without knowing how to use the Stripe API. And, for those that do know how, not everyone wants to invest the time to do so.

I don't think most of what Snappy Checkout does is on Stripe's roadmap. Unless they are planning on building a full-featured checkout system.
Loom.io: Collaborative Decision-Making
n.b. Nick is a Stack Exchange system administrator
Great job! I'll definitely be giving this a shot!

Quick question, though... Do you use Stripe's Connect API for the 50 cent transaction fee you're taking (application_fee)?
Theoretical cryptographers -- those who come up with new encryption schemes like the classics we rely on, e.g RSA and DH -- will take the following perspective:

Every encryption scheme is based on the assumption "X is not solvable in polynomial time", for some problem X. Don't start by wasting time with details of the scheme. Start by telling me X.

Common examples of X are factoring and discrete log. More exotic ones include e.g. [1], the types of assumptions underlying fully homomorphic encryption.
In the case of this bio paper, cryptographers won't care unless the authors can succinctly describe:

1. The computational problem that needs to be solved to break their scheme.

2. The relationship of this computational problem to well-known ones (can it be reduced to factoring? To computing some difficult integral?).

3. Evidence to suggest this problem is difficult (can factoring be reduced to it? Or some other hard problem?).

[1] http://en.wikipedia.org/wiki/Lattice-based_cryptography
3000 views in 3 days and how to keep it going?
A few days back I created a platform for finding a minimum viable product/idea and solving them. So far the results so far are pretty good 3000 views in 3 days and people are actually telling their problem whats your?
So i've been trying to find an the ideal case for mongodb, because I have to teach a nosql database to some people I am mentoring.

I'm leaning heavily towards couchdb though.

http://daemon.co.za/2014/04/when-is-mongodb-the-right-tool
Not at the moment. It should be possible to do though if that data can be retrieved in some common format -- like CSV.
I also object to the suggestion that either gender is superior. Girls are our "greatest resource?" Really? What about boys? How would people respond if I made a video suggesting that boys are greatest? After all, they're bigger and stronger, and have had more scientific achievements.

I'm not an expert, but I actually think that there is current data to suggest that boys today are having much more trouble learning and focusing than girls. I think there might even be more girls enrolled in college than boys.
Yeah, the specs are an improvement over some other options, but can't break much out on two layers.
Because the whole problem it is solving is that both matrix multiplication and elementwise multiplication are frequently used enough that there is API fragmentation in popular matrix-using Python libraries between places where * is used for matrix multiplication and places where it is used for elementwise multiplication. Read the linked PEP, this is addressed, at length.
Very useful ruby lint
Obituary: Windows XP
as long as your panel is less than 10x10cm.

I guess they panelize internally at a period of 10x10cm(+margin).
> I don't think it's possible to charge existing customers from Stripe's admin right now.

I don't think this is correct. Stripe (and the Stripe Admin UI) gives you enormous power to charge/upgrade/downgrade/enroll existing customers.

I'm curious, why did you choose to implement your own subscriptions, instead of utilizing Stripe's? This is a much more appealing option if its a clean integration that simply leverages all of Stripe's features (MoonClerk does this well).
Love this

> Is there a bright side to all this?
Cheap solar power – at night
I don't think this is true. When it comes to copying bytes from a buffer supplied from the network, there isn't a wrapper/manager class that can do this for you. Somewhere down the pipeline some piece of code has to copy the unstructured, variable length byte stream into a manageable data structure. C++ does not give any way to do this beyond the mechanisms available in C.
Building a Decoder for the CVE-2014-0502 Shellcode
I use backticks a lot when writing Markdown and Ruby code and it's easy to type (on a Mac keyboard at least) and is as easy to print as any other character.
> That extra step is in there because I check the customer's IP address to ensure it's the same on every download attempt. If the IP address changes, I send the customer a new download link via email.

That is a very clever solution to a very difficult problem. I love it!
This is the way F1 turbo/engine is specified to work. Not specific to Mercedes. Only the split turbine/compressor is Mercedes specific.
No. The fee is charged at the beginning of the month. So, for all payments received in April, you'll be charged 50 cents per payment on May 1st.

I thought of using Stripe's API to remove the 50 cents right away, but that's not possible since it wouldn't work for PayPal payments.
Memo to the Amateur Cipher Designer [1998]
AngularStrap is a set of native directives that enables seamless integration of Twitter Bootstrap 3.0+ into your AngularJS 1.2+ app.
Love it, I've just registered ^_^ Thanks.
Although one-time pads are indeed unbreakable in a mathematical sense, in the real world everything is theoretically decipherable, in the end, using rubber-hose cryptanalysis and good timing.

http://xkcd.com/538/

Possible defenses against rubber hose cryptanalysis on your one time pads include:

Perfect forward secrecy and plausible deniability

Hidden hard drives within hard drives within hard drives http://www.truecrypt.org/

Being dead http://www.cracked.com/article_20110_5-secret-languages-that...

Quantum mechanics http://en.m.wikipedia.org/wiki/Quantum_key_distribution
> And sending the message length is a bit of an information leak itself.

The known solution to this is to pad messages to some fixed length. The obvious drawback is that you have to choose the fixed length message to be as long as the longest message you may wish to transmit, which could result in having to transmit rather a lot of padding.

The equivalent of this for real-time communications is to transmit continually at a fixed bit rate regardless of whether you have any data to send at any given time.
A Word Processor with a Crowd Inside
It's typical for crypto algorithms to generate an endless (or extremely large) "keystream" by permutating a much shorter secret key with other data somehow.

The fact they're not using the term "keystream" for this concept is a bit of a warning that they might've reinvented something every cipher algo already does, but more inefficient (from skimming through the paper).

Just guessing though. Not judging. I'm not a cryptographer, I just read about crypto as a hobby (and to know what I'm doing while using someone else's crypto primitives in my code).
I'm amused to note that this probably applies to Yahoo Groups as well, since it uses the yahoogroups.com domain, not a yahoo.com domain.

Looking at the headers of a recent message from a Yahoo user over Yahoo groups it seems like it would be the case:

dkim=pass header.i=@yahoogroups.com;
dmarc=pass (p=REJECT dis=NONE) header.from=yahoo.com

Of course, anyone who is using Yahoo Groups regularly has probably noticed that even with last year's redesign it's not getting much attention.
I think he is suggesting VCs want much larger exits than the average founder (at higher risk). Isn't most of Y combinator's success from just a couple massive paydays (airbnb and dropbox etc)? Whereas an exit like reddit in the 15 - 20 MM range is considered a big win for the founders, but quite "meh" for the investors. VCs need big wins to be really successful.
"x = @y" will call y.__dec__. "@foo" behind a function will call foo.__dec__ with the function as an argument, meaning decoration behaviour can then be altered or be even completely different for other classes.

As I said, there is DSL potential. As it stands, it's just something that is not possible.
RSA’s Coviello: Opportunities for Cyberattack Multiplying
No. Here is the explanation:

"However, LastPass is unique in that your data is also encrypted with a key that LastPass servers don’t have access to. Your sensitive data is never transmitted over SSL unencrypted - it’s already encrypted when it is transmitted, with a key LastPass never receives. While this bug is still very serious, it could not expose LastPass customers’ encrypted data due to our extra layers of protection. On the majority of the web, user data is not encrypted before being transmitted over SSL, hence the widespread concern."
Am I the only one who thinks 50 cents per transaction (in addition to the Stripe/Paypal) fees is still an awful lot?

For the typical $5/mo SaaS subscription, that's a full 10% just to pay for your checkout system (not including the payment system).

That said, our team is likely not Snappy Checkout's audience as we're devs who can integrate Stripe/Paypal ourselves.
Ask HN: Someone is offering to buy my side project
At the beginning of the year I made an application for Google Glass that would manage a student's courses and home work assignments (www.myhomework4glass.com). It was my first time with Android development, and all together it took me about four weeks to build and deploy. So far it's got about 90 semi-regular users, which I'm very proud of, especially considering the market is so small.

Today I got an email from someone asking for the source code for the project, offering "a reasonable amount of money of [my] choosing."

Since there's no real market for Google Glass yet the project hasn't brought me any income other than a single $10 Paypal donation, but I'm not sure if it would be a good idea to sell out the source code. I just started programming about a year ago, so I've never had an offer like this before. I don't even know what I would value this code at.

Just wondering if anyone has some advice on how I should proceed, or how to value the code I've written.
I'm surprised that I haven't been contacted by any sites yet with advice to reset my password. Is it the case that not many sites were actually running 1.0.1? Or are they just patching, creating new certs, and calling it a day?
In the referenced article (https://www.schneier.com/crypto-gram-9810.html#cipherdesign), he says:

> Algorithms posted to Internet newsgroups by unknowns won't get a second glance.

It seems to me this would not be true of Bitcoin.
Hijacking user sessions with the Heartbleed vulnerability
Yes, even when paying for art this can and does happen. I think some time ago there was a case where someone put a photo from the phillipines on Twitter, an agency downloaded it, and sold it on to customers, several of which had to pay millions in restitution to the original - and probably somewhat happy - photographer.

The more I know about copyright law the less I feel like creating anything at all. Here in Germany I can barely publish any photo with a child anywhere in it, and it gets only moderately easier with adults. Everything requires consent forms.
Kenya vs Nigeria: Tech Startup Ecosystem Comparison
Strictly speaking, they are rendered on client side with WebGL, so all the data is already on your machine...
Sometimes you have to stretch to find some arbitrary point you can hang a negative viewpoint on otherwise what is the point.

It's one of the things I enjoy about HN "Oh you cured cancer and it costs $10 a dose and can be made in a kitchen, brilliant but the site doesn't work properly on Firefox Pre-Alpha on Solaris so I have no faith in you".

It used to bother me but somewhere down the line I just stopped reading the comments and looked for the positive stuff instead.
hobbyist time is considered free. If you are talking about ROI, then you're in a different league.
TokuMX does have MVCC
Of course. I made them harmless and walked right through them.
sweet then, will give tokumx a shot as well. Thanks
For me it's always the triple-whammy of being a bit (or a lot) slower, needing vastly more memory, and having astronomical startup times. Not exactly an appealing combination.
> while it's unlikely that this will allow the aircraft carrier to regain the place it once held

The very first thing I thought after all that waxing poetic about destroying a $2M missile with a $20,000 slug was, "OK, now what happens if the enemy launches a couple missiles at the same time?"

And heck, while we're at it you probably don't need such sophisticated guidance equipment if you aren't perching all your eggs on top of one rocket. . . so can this thing achieve a high enough rate of fire to put even a tiny little dent in a large salvo of cheap missiles?
On the second thought, yes it's a lot and I'd prefer flat per month fee like E-junkie does with the secure downloads hosted on the provider server/S3 not my personal Dropbox.
It seems some servers had some combination of nginx+openssl that caused the memory location being dumped to always be a recent HTTP request/response. Keep hitting that enough times and you'll get all sorts of goodies (session cookies, cleartext passwords).

This tweet shows someone getting credentials from Yahoo Mail:
https://twitter.com/markloman/status/453502888447586304

I think any service who suspects they've been vulnerable should issue a forced password reset email to their users. Even if there's only an infinitesimal chance of credential disclosure, how can you be sure, and why not take precautions?
6 Things Entrepreneurs Wish Family, Friends and Employees Understood
This means "your passwords are safe, because they're encrypted with a key that only you have".

It still means people could have hijacked your session, which is what GP was referring to.

I don't use LastPass, but I speculate even if your data isn't vulnerable, people could use your ID/password to do malicious things (denial of service to your passwords being the first thought).
How many tries did it take to get the whole key?
The code to test for membership of a key value pair is already straightforward for any mapping:

map[key]==value

Which is a weak reason in support of the use of containment testing for something else.
The url is http://dirtypcbs.com/ and the title on the page is "Dirt Cheap Dirty Boards" and the tag-line is 'No bull, just crappy PCBs'.

I get that they're trying to convey 'quick and dirty', but they're only saying the dirty, crappy part of it, and de-emphasizing the cheap and easy. To me it says not environmentally friendly crap.

It's totally their marketing decision to make though. It would be interesting to see them comment about this, and what their rationale was in choosing the name (it could be that this was extremely well tested and researched).

I'll be using them, anyway!
Collection of patterns and modules for responsive emails
Looks awesome. A great checkout experience is always a delight to use. Even Amazon's feels kind of clunky if you have to enter credit card information.
This is a great point. At $5, 50 cents is more expensive than the other payment systems that charge a percentage of the sale price (e.g. Gumroad).
I think that's the purpose, the filename says something about "exception".
On Chrome (Version 32.0.1700.77) it went to 69/100, then a moment later continued to 99/100. I reloaded the page and that time it went all the way to 100 smoothly.
Depends on needs, as there are some pretty sane people who don't want to be IT support for all their friends hosting small projects, and don't want to have to install and manage alternative control panels for them. Bugs, issues, quirks and all, cPanel and hosts that offer it may be fine for folks with limited needs or relatively clean/secure apps.

But sure, for the most savvy of devs and ops people, cPanel hosts may not be the right setup.
IE10 is too aggressive a goal. Can't require OS upgrades...
Mapping San Francisco Locations Using Facebook Data
Also, LastPass has employed a feature called “perfect forward secrecy”. This ensures that when security keys are changed, past and future traffic also can’t be decrypted even when a particular security key is compromised.

I thought perfect forward secrecy simply gives you plausible deniability, or is that in the particular case of Off The Record messaging? How is it that a key I could have used yesterday to decrypt all the traffic I was capturing until yesterday suddely cannot be used to decrypt the same data, if none of it has changed in my vault?
Drones on Demand – Uber for Drones
Having to support IE8 Compatibility mode for a bank is worse than IE6 - at least IE6 issues and fixes are documented. IE8 Compatibility mode is a world of pain, add in some proxy servers and latency sensitive JS and you have a fun fronted time.
Adding @ for matrix multiplication is to enable a consistent matrix API for python where * is always elementwise multiplication. Numpy -- and other major projects that use * for matrix multiplication in APIs, as reported in the PEP -- have committed to migrate to the new standard approach once the PEP is implemented.
For Q2 and Q3 services build on top of the company I work for. (Spreedly.com) We vault the cards independently and work with 60 different gateways.

(Congrats Mike and sorry to chime in on your thread)
What should I do about Windows XP computers that we need to keep?
In our lab we have a collection of equipment where each piece has a dedicated windows XP computer (a Wyko interferometer for example). What is the best way to deal with the end of support for these machines?

The hardware is very expensive to upgrade, and upgrading would basically mean throwing it out and starting over with new equipment.

There is also no path to upgrade to Windows 7.
I thought that too, until they mentioned logins at the end. Perhaps you are right.

It would appear the session info would be compromised, but the login credentials would be protected.
How much of that is genuinely down to HFT, and how much is down to changing the "protocol"? Keep in mind that in the bad old days, it was simply impossible to place orders at a cent-level granularity for most stocks.

You could probably get the same benefits by (a) forcing exchanges to allow something like a 10^-9 granularity of prices, (b) restricting matching engines to operate on something like a 15 minute heartbeat, (c) regulating the crap out of exchanges to lower the barrier of entry.

You'd get reasonably low spreads while eliminating the waste of resources caused by the high speed arms race. At the same time, for individuals who actually invest (rather than speculate/trade), the spread is a distraction. Access to markets and fees are the real hurdle.
The question is... how much does the railgun itself cost per shot? $25,000 per round is cheap enough, but what's the impact of each firing on the gun?

Missles and shells are expensive mostly because they have to propel themselves, but they benefit from the fact that that propulsion system only has to work one time. A useful railgun will need to be able to fire thousands of times without major maintenance before you'll start seeing any cost benefit to cheap ammunition.
Play It Again And Again, Sam
Only one downside - someone could hack the implant and gain control over his body.
Tried that, but for some reason I couldn't disable the onCollision by assigning it to some dummy function. Do you mind sharing your solution?
Ask HN: Part number generation and tracking
How do those of you who have physical products track the creation of part numbers? I'm trying to find a good way to automatically generate new numbers that doesn't have to be manually maintained.

The fallback is a spreadsheet that has controlled access, but that seems very cumbersome.
Maybe the cert was different before this moment, but yeah, the CN is *.stackexchange.com, but it has suitable Subject Alternative Names for the other domains.
I think they are looking for more of a Office Manager, someone to handle the day to day operations, than someone to manage people.
Potential for growth: If things go well, you will be COO.

that's a scary line to put in a job description
this comes 1 year after a slimier massive operation a year ago.

quoting anonymous press release
". We are Anonymous.
3.
4. To the government of Israel:
5.
6. For too long we have tolerated your crimes against humanity during the ceasefire and allowed your sins to go unpunished.
7. Through the use of media deception and political bribery, you have amassed the sympathies of many. You claim to want peace, yet the reality on the ground speaks differently."
I remember the Beastie Boys controversy, but what's this about a dying wish?
You are at the whims of the clients and the browsers they are using.

But, you already are, as they decide whether or not to trust or verify the authenticity of your certificate.

You can and should revoke, but it's not clear to me that you can increase the efficacy of that action with your clients.
If I was using one-time-pads I'd probably be using them because I didn't trust encryption, so "unencrypted" wouldn't matter here.

In real-world implementations I think the security is probably based around a large number of men with guns.
A good solution would be to remove an invalid item, and the function should silently try to remove the invalid item, but still allow passage. For some reason, even when you have the green key, but try to remove an invalid item, it still doesn't let you through, despite apparently returning false (passable).

Additionally it doesn't support injection there, so while "player.removeItem('greenKey'); player.additem('greenKey');" should work, it says "TypeError: undefined is not a function".
When you transmit the pads may not correspond with when you want the message sent.

For example I may be able to send you a one-time pad securely today, but the message I need to tell you ("buy GM stock at 37.82") I won't know until next week -- at which point I may not be able to expediently send you the one-time pad securely.
How Nigeria Became Africa's Largest Economy Overnight