skysight-inc/HackerNews huggingface dataset:
> Is there any historical evidence of disclosures from the NSA to the open-source community?

I would suspect that NSA would want to conceal the fact that the disclosure came from them.
Haskell Cheat Sheet [pdf]
Also interesting are the other three blog entries, particularly "Entropy Attacks!" that talks about how hashing RDRAND into an entropy pool right before using it (an obvious use that seems like a good idea) could, with a malicious implementation, cause a lower entropy output that would reveal your DSA private key...
Build and manage large sets of apartments, flats, or condos (depending on location) for students. Rented very cheaply, but available only to people who didn't drop out, or fail their courses.

Student accommodation in the UK is frequently nasty, expensive, and hard to find.

Beyond that a new camera, and probably a new house for myself. But nothing too insane.
Get Mental Notes
This is a cool idea. This isn't really a pain point for me but I immediately thought of a couple of people in family (aunts) who are very active gift givers in a large family. I would imagine mother's with small children would be a target market for you (they tend to have to keep up with a lot birthdays). But that's just an assumption. With that said, I would suggest making the site for friendly for non-technical users. I think the "bot" terminology would lose them.

With that said, I'll bookmark your site and pass it along to people I think would be your users.
Days like today I really miss GrokLaw to itty bitty pieces.

Yeah, I has a sad.
Here's one :

A Possible Future of Software Development : www.youtube.com/watch?v=4moyKUHApq4‎
Amazon pays $95k for new grads. SDE3 is around $120k.
That's a hard problem. If you have some material like that with a clear recording, the only good commercial solution that I know of is Melodyne, and he's not saying how he does it. In theory you just look for multiple peaks in the FFT, but this is much easier said than done.
Aren't strings immutable in most languages? Like in javascript, String.slice() returns a copy, it does not mutate the original string.

I don't disagree with you, but I don't see how it's a disastrous problem, either.
This is just speculation, but Amazon isn't known for playing very nice in the open-source community. Maybe they lacked the personal relationships required for someone in the know to trust them. OpenSSL, CloudFlare, Google … those are all open-source shops.
Sounds pretty awesome, could definitely see the demand case for this. What stack is it built in? Are the updates real time?
After my experience with the first-gen Kindle Fire, I'm disinclined to ever buy hardware from Amazon again.
How I can help: I'm a Haskell developer and I'm willing to develop moderately-sized applications for you in my spare time.

What I need: I would like some personal branding advice (coaching) from someone who is good at it. I've been reading online resources about the topic but it's not enough.
Budget, mission, and legal privileges.

For the money they get, and the supposed "Cyber Command" mission, they should have a team of great auditors, and advanced tools, that's much larger and more competent than the volunteer OpenSSL team itself. This group should go over all similar code multiple times with a magnifying glass.

Otherwise, what's the point of the NSA & Cyber Command, on its own stated terms?
Unfortunately that "we" is the government officials themselves.
It seems to me that the goal of selling smartphones is no longer to profit from the sale of hardware, but to put your own services and content stores in front of the user. We've been seeing this in the PC industry for a couple decades now, with moderate push back from Microsoft.
Ejabberd clustering sucks.
Grandstand much?
Awesome idea, something I've been wanting to see for a while. Maybe add a splash/about page to give more information on what it is for people who happen upon the site from other sources than HN, where it has been described.
In the beginning, when Theo was cast out of NetBSD, someone rewrote this thing

http://www.skrause.org/humor/poohgoesapeshit.shtml

with Theo and other BSD-ish personalities as the characters. There are many stories of prickly people mellowing with age. It's unlikely there'll be such a story about him.
hmm, all I'm getting is a bunch of dicks...

0600: 20 38 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 44 20 20 8===========D
0610: 20 38 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 44 20 20 8===========D
0620: 20 38 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 44 20 20 8===========D
0630: 20 38 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 44 20 20 8===========D
The most famous example is the DES S-boxes, where the NSA made a change that nobody else understood - until years later, when it was discovered that they had made the algorithm more secure against cryptanalysis techniques that had just been "discovered", but which had evidently been known to NSA long before.
Considering that the NSA has known about this bug for up to two years[1], I think it's optimistic to consider that they'd be willing to help in this regard, as they've very possibly been exploiting it for some time now.

[1] - http://reason.com/24-7/2014/04/11/nsa-allegedly-knew-about-m...
The FreeBSD Security Team works with other software distributors to make sure that they have advisories and patches ready when bugs are first disclosed publicly.

In my years as FreeBSD Security Officer, we in very rare cases gave advance notice of vulnerabilities to end users, and those decisions were made on the basis of "we happen to know that these people are using the software in a way which makes them particularly vulnerable". (In most or all such cases we didn't even provide a patch, just a warning of "make sure you have people around at 10AM tomorrow in case you need to release an update quickly".)

Nobody ever got advance notice by virtue of having donated money, and I reminded Security Team members that they should not give any advance disclosure to their employers.
Help me out: I created a website, but I don't really know what to do with it, or if it's even worth doing anything with it.

https://www.recruiterator.com/

In short the site is like rate my professor for recruiters.

What I can offer.

Web Development, .Net, Java, Android or Windows Phone programming.
>You'd either want to talk to some senior in IT security or anyone above them, upto including the CTO or someone in risk management/liability. Doing sales to those people is most likely expensive, probably costing $10k+ per client which would be the cost of someone going to networking events, visiting prospects, presentations, documents etc.

This is why I'm suggesting something that can be sold online, at a price point that doesn't require per-customer sales effort. I don't have many $1000 per year customers, but I have a few; and I have a fair number of $500+ per year customers. I did not spend more sales effort on those customers than I did on my $100/year customers.

I say this as evidence that $1000/year is below the "high touch sales" threshold.
Practically it would just mean they send an email to the priority support list before they send it to the listserv

Mail servers are fast enough these days that I don't think that it really matters what order the emails go out in. Maybe someone would want to pay to get a phone call when an advisory goes out, though.

I have no objection to providing support for paying customers, e.g., to help them figure out if they're affected by a bug. But money should not result in you hearing about a bug any earlier.
I dunno. I think the effort might be worthy of the EFF's time if they have the expertise. I don't think that any EFF donors would be upset that they spent time to help OpenSSL setup a non-profit.
That Pretty Much Wraps it Up for C
No.

The line of thinking is, "Well, if we had real numbers, we could compute uncomputable functions." No shit. Most real numbers are not computable. If you start with something not computable, you end up with something not computable.

The big problem is that there is no way you will get more than several digits of precision on anything. The next problem is that there's zero evidence that anything in the universe is capable of encoding an arbitrary real number, even within a given bound. The last problem is that making a "real-number" machine capable of solving a problem that a Turing machine can't basically requires knowing the answer ahead of time and encoding it into the real-number machine as a constant. Unclear how you'd do that.
KOAN Stack (Koa, Angular, Node, Mongo, WebSockets)
Create a Culture of Prospecting in Your Startup
You offer this membership only to trustworthy members of the community who have interest in keeping their services and products secure such as RedHat, Google, Facebook, Oracle, Debian and so on. I think you can trust people in Google not to exploit vulnerability and not to sell it for bitcoins.

Unless critical vulnerability is exploited in the wild, it should first be disclosed to big Linux distributors so they can prepare patches and to companies responsible for critical Internet infrastructure so they can fix their system before telling general public. With this proposal you just charge companies who can afford it membership fees and provide this service for free to open source/non profits who could not afford it.
PS: I also take issue with the "paid security researcher" remark. Absolutely nothing in either Free or Open Source excludes paid personnel or private companies from the equation. Hobbyist programmers are not the only ones accepted. I don't understand why you see this as extraordinary.

I never meant to imply paid researchers should not work on it. What I meant is:

The whole world can see every line of code in Linux. This is one of the reasons Linux is more secure than other operating systems and why open-source software overall is a safer than closed software. The transparency of the code ensures it’s secure. - Linux Foundation executive director Jim Zemlin

http://venturebeat.com/2013/11/26/linux-chief-open-source-is...

What happened in the case of Heartbleed? The security flaw was found by paying someone to work on the security.

I meant to mock this: The transparency of the code ensures it’s secure., mocking it by noting that nobody cared to look for or fix that bug because OpenSSL was important, because it was widely used, because it was interesting, because it was open source, because it was a puzzle, just for something to do one rainy day. Only when someone was paid to do it did it get done. Therefore the "open source is more secure" claim is a nonsense.

It's more secure because someone was paid to work on it. The claim that "open source did it" is snake oil.
>>If this is true, and the NSA knew about the Heartbleed vulnerability, then how come the EFF hasn't been getting more log data showing the vulnerability being exploited against sites?

So, I have no idea if the NSA knew about this before or not but your typically configured webserver won't store these in access.log. Also, all the network stuff in between typically won't log SSL traffic(since it's just binary blobs without the private key)
benefits

Over what? Are you seeking a comparison with releasing one a day, a week, a month, a year?

One of the responses to your question contrasts multiple-times-daily releases with once-every-two-months releases. There are certainly clear benefits there. Personally, i am less convinced of the net benefits of multiple-times-daily releases over a once-a-day or even once-a-week releases.

I work on a few apps which have fast release cycles, where we often release several times a week, and occasionally release several times a day.

One big benefit is the ability to fix bugs fast. When a customer service rep comes over and tells us about a mistake in the data we are showing our users, or a sysadmin comes up and tells us about some alerts we're causing on his dashboard, we can quite often fix the bug and release the fix the same day. That really helps keep customers and sysadmins happy.

Another benefit is the ability to get metrics into production fast. If we're making plans, sometimes we realise that we really need more information about the behaviour of the system or users to make a good decision. If that's information that can be captured in metrics or log events, we can add the metric release, and then gather information quickly enough not to completely derail our planning process.

The ability to add metrics fast also helps with tracking down bugs, because we can essentially instrument the production system on demand. For example, at one point, we had a suspicion that some service that took two overlapping date ranges as parameters was being called with date ranges that did not overlap. So we added a check for that which logged an event if they didn't, and pushed it to production. The next morning, we knew exactly how much this was happening, and which other application the was making the calls.

The flip side of this is that our frequently-released apps get essentially no meaningful manual QA, and precious little automatic testing. We have huge suites of tests which we run in CI, of course, but we don't have time to put every release through soak or performance tests.

If you wanted to make a general handwavy statement, i'd say that having really fast release cycles helps break down the wall between development and production. Which you might or might not find was a good thing.
Yes, they helped improve DES

http://arstechnica.com/security/2013/09/the-nsas-work-to-mak...
Peter Bailis's talk at Ricon West (https://www.youtube.com/watch?v=_rAdJkAbGls) is a good introduction to this topic, and is more approachable than the full paper.

This is very interesting research, both as a piece of distributed systems theory and as something that's likely to change the way (some) large-scale database systems are designed. When reading this paper it's worth noting that a lot of the conversation, in both academia and industry, around distributed systems is a conversation about constraints. From time to time new and profound results do show up, but the general thread of research is looking at application requirements and looking at system models, and trying to find new and interesting ways to meet these application requirements in the provided system models. This research, the earlier HAT research from the same group, and active research into CRDTs are all great examples of this. I'm not trying to diminish the importance of this research by explaining it this way. Indeed, the 'how do we solve this constraint in this model' research is generally more immediately useful, more applicable, and has a faster turn-around to production systems than the more purely mathematically-focused research in the same fields.

This kind of thing is really going to make it to a database near you, and give distributed databases a great shot at beating single-machine databases in some areas where they lag behind today.
Interestingly, he is still incarcerated.

http://i.imgur.com/fe6sfyU.png
They want haters to DDOS Tumblr instead of the .gov. No doubt it is strange and as always with the NSA there is a reason for it.
Can't speak for the OP. In my case "code every day" is meaningful because I have a lot of responsibilities outside of writing code. It's good to have a reminder to always get in a bit of coding time at least.

That doesn't make me a workaholic. I'll still stick to ~8h days. It just means I'm not completely forgetting about the coding side for a couple of days and then feeling super-guilty there's no commit for a week.

(Obviously, Sat/Sun are exempt from "code every day".)
So it looks like you might be right. Debian uses Apache mpm_worker by default, and after getting a test install running and using ab to provide load I managed to get the private key in under a minute on the first run: http://t.co/nYvIw7q4M8 (I was lucky the first time, usually it seems to take a little longer.)
HMO: I just put up a MVP in a beta test. It's a workflow where you can build a data interactive with maps, charts and graphs to embed in your website/blog articles. I put up the workflow and then created a survey at the end to gather the tester's feedback. Would love some feedback.

http://thedata.directory/

HYO: would happily help anyone out with some beta testing/user feedback.
Though from the sounds of it, it doesn't work very well presumably because there is no outbound sales process - which is what this person is suggesting doing.
I don't use Twitter, but based on what I see on Instagram, I agree with the parent that those people look like asses. It comes off as whoring for followers, and a bit desperate.

I think it's different, however, if there are a few hashtags at the end which in themselves are jokes or metajokes and that add to the cleverness of the post, in the same way that XKCD alt-text does. A string of simple categories (#joke #jokes #funny #comedy) is just annoying.
So let's assume that a geek user is just as likely to be a free user as a non-geek user[]. Then, the geeks leaving their service is a net loss to them, because how would it not be that? If it really was the case that geeks leaving the service was a net win to them, then their whole user base - which you'll recall, we assume has the same proportion to free to non-free users as the geek subset - is a net loss to them, either right now or overall, violating the more fundamental assumption that dropbox has a self-serving business model. Thus we have arrived at a contradiction, forcing us to accept that geeks leaving the service is a net loss to dropbox.

We don't consider the case where geek users are more likely to have a non-free plan than non-geek users, since then that is obviously a net loss to dropbox if they leave, under the reasonable assumption that paying users of dropbox are more profitable to dropbox then their free user brethren.

The last possibility, that non-geek users are more likely to be paying users than geek users, is no more likely than the two scenarios above, according to your own knowledge. So why did you assert that geek users are a net loss to dropbox to begin with?

[] and also that these two sets of users is a partitioning of the whole set of users.
I'm not saying there is anything wrong with driving fast or hunting/shooting guns - I'm just saying there is a context in which those activities are not acceptable, and that context is when you are acting unsafely and subjecting other people to unnecessary risk.

Note when I say park, I mean a city park, not a state park or wildlife park or wherever hunting is actually permitted.
I sure hope Mr. Snowden has evidence to the contrary.
> I just find it depressing how ready the media is to jump on the NSA for things they may not have done.

I don't like journalism and such, but I think it's OK in this case and I don't find it a bit depressing, maybe even otherwise. Why? Because we should be aware. Always. There's no sense in blaming NSA for something. It's stupid to blame spies for spying. There's no sense in saying something they do is immoral, because it couldn't stop them from doing it. So if you care about them doing something wrong the only way to stop it is to make it impossible. If you don't want NSA to know some data that belong to you — you are enemies, because NSA wants to know anything. And it's OK. It's what they are for.

You obviously cannot prevent what already happened, you can only try to fix the consequences and be more careful in the future. So it's always sensible to assume NSA knew about any single security bug discovered for a long time. And nobody can possibly know if something is true about NSA's knowledge (maybe even not NSA themselves). So even if it's not true — spreading rumors about it is completely fine I guess.
I would argue that TJ's Github credentials don't necessarily make the best argument for his long term project. The guy is brilliant and prolific, but he admits to not being the best at long-term maintenance.

For instance, his response to the whole n rm -rf debacle: "yeah it's kinda tough when you have 250+ OSS projects, inevitably some get messed up over time and I merge broken shit haha". That being said, it looks like he's let other folks take over Express (who are all qualified). He didn't even know the logger was named "Morgan" until he read it in a blog post about Express 4.
NIST has been compromised/infiltrated/coerced by the NSA. They are not to be trusted.
Thanks for the note. Had noticed that Bahir promotet his MCnext server, but did not know about this.
If this is "legit," then it's one of the weirdest things ever. I can't see why any official statement wouldn't be under a .gov.
Lean B2B: Build Products Businesses Want
Why is this going to be different from r/mfa or StyleForum or the hundreds of other books on fashion that exist? In other words, what do you have to bring to the table so that I would buy your book to learn about fashion? What is your USP?
No doubt this is part of their PR strategy. "Look, we use Tumblr just like you. We don't have any fancy blogging platform. In fact, we don't have any fancy tool at all. All we do is boring administrative work."
> despite much rhetoric form the Republicans telling people how weak that supposedly made Obama look

As I said, look at Kerry's talks. He's very much a part of the Democrat establishment and completely contradicts what you're saying.

Now, look at Rand's position on these same countries. The false dichotomy you're presenting is exactly that - false.
Great idea actually. Someone should make a project for this.
The latest reports are saying that there are a number of unverified infections in the nations surrounding Guinea and Liberia. Nobody knows until the testing is done.

The big problem is that it's in a city. It's easier to control when it hits isolated villages.
That's certainly not how we do it at Google.
The DoD funded it because they're worried about weaponized Ebola and Marburg. Given that the DoD is in the middle of a budget crunch, it's believable that they'd cut funding for defense programs against less-likely military threats.
@humbit https://twitter.com/humbit
What Happened to the Hominids Who May Have Been Smarter Than Us?
Snowplow 0.9.1 released with initial JSON support
Interesting question - is the author's transcription a derivative work of the video? And if so, is he actually allowed to release his transcription into the public domain (without the permission of the author of the video)?
You act like they've never made a mistake before.
Just signed up for the invite. FYI you convinced me to sign up 3:30 minutes into the vide demo.
I'm guessing that "the way [documents are] advertised" refers to some of the "hello world"-style examples that are found in various blogs. I'll agree that in their enthusiasm for showing how easy it is to use put data into and retrieve data from a document store (no O/R mapping!) they assume that the reader is well-versed in data modeling. This has bitten numerous inexperienced developers. I've never seen an article recommend against data normalization though.
One of the factors that keeps Ebola from causing massive epidemics and pandemics is it's rapid mortality rate. It kills people relatively fast and consistently, so outbreaks often burn themselves out.

https://en.wikipedia.org/wiki/Ebola_virus_disease#Epidemiolo...

If you're curious, The Coming Plague is a very interesting book that covers many hemorrhagic fevers like Ebola: http://www.amazon.com/The-Coming-Plague-Emerging-Diseases/dp...
Ah thanks. I'm not that into coffee, just wanted to try something new that someone else likes, at random. Thanks for the suggestion!
It seems this is where most hardware is headed. Companies just want to get people integrated into their ecosystems as quickly and easily as possible. They don't really care to make money off the hardware itself. Also, the cost of manufacturing many of these devices is practically negligible at this point.
Oh goodie, another fucking platform to market, design, develop and test for.
This would be really helpful if I could search or filter by task. So many times there's something I know a web app must be able to do, but Google produces sub-par results when searching for these kinds of terms.