skysight-inc/HackerNews huggingface dataset:
No advance channel set up?

This stuff is always tricky, and I admittedly have a strong adverse reaction to the "just blow everything open, it will be lulzy when the web breaks" attitude.

To be on such a list you also need to have a positive prior record demonstrating your ability to keep your mouth shut, which is hard to prove.
My assumption would be that this formally verified implementation is not optimized, and therefore runs rather slowly compared to the C implementations. Plus it requires the .NET framework or Mono to run it. Am I off base?
No matter where you end up working, some of the things you are going to be expected to do will be things that you aren't interested in doing. So far, your performance in college hasn't proven that you are capable of holding down a job. Right or wrong, from the perspective of an employer, the situation you described above would make me worry that you might have an aversion to hard work.

I'm not saying that you should stay in school, even though it would be a good idea, but maybe instead you should build a few personal projects from start to finish. That will allow you to demonstrate to employers that you are capable of working through the hard/boring parts of software development and pushing through to the end.

Also, you need to get your sleeping disorder under control. Being tired all the time kills your ability to concentrate and execute. See a doctor if you have to. If you don't take care of yourself now, you'll regret it when you are older.
Even if we generate a new key pair and replace our certificate, aren’t we still vulnerable to MIM attacks if someone had downloaded the old private key and use the old certificate?
until it's revoked.
That's a neat list. I wish the column headers were repeated for every section so you didn't have to keep scrolling back and forth.
Hi aw3c2, thank you for pointing that out. Our standard Wordpress account does not seem to have an option to change those links, and we've focused our web development resources so far on improving our main website rather than our blog. As a temporary measure, I've added links to our website to the blog post itself.
Did you "service httpd restart" after applying the update?
Yes. Certification revocation doesn't work in MITM scenario because of the way it's implemented in every major browser:

http://news.netcraft.com/archives/2013/05/13/how-certificate...
What about the Postgres bug from I think last year where instead of putting up a fancy looking site the people involved coordinated in secret with every major distro to release a patched package? That seemed to me to be much more professional. Or is this bug significantly different?
#GetStarted2014
Lets make a datepicker with React.js
There seems to be a big trend toward authors publishing programming books for free online and offering hard copies that you buy, too. In general, if someone offers me a free product and a paid one, I'll stick with free. No surprise there. But coding books are an interesting exception.

I find it much easier to learn a new language when I'm using a book instead of reading it for free online. A book is a single-purpose device; you can only use it to learn about one topic, or set of topics. It doesn't vibrate, notify me of emails and text or encourage me to go on other tangents. For a goal such as learning R or Haskell, which requires a lot of mental energy, having this extra focus makes a big difference.
Why do heartbeats need payloads?
The NSA has two mandates. First, it is to ensure that Americans are using secure communication channels. Second, it is to collect data. When these two things come into conflict they have the authority to make a decision. For centralized communication channels, for example, they will often help beef up security in exchange for the ability to wiretap.

If this bug was not caught by the NSA, then they are incompetent, something that I've rarely seen levelled at them as of late, but it is possible. If this bug was perpetrated by the NSA, then they are evil because they are exposing Nato and other allied countries to foreign attacks and corporate espionage.

Given the stakes, what they've said in the PRISM slides, and their history, I'd say evil is more likely than incompetent.
I just wish people would stop using "amateur" as an insult.
I read the words in your blog post and came to a completely different conclusion.

Despite not putting time stamps on their communications (which you seem really really upset about), they fixed everything for everybody in like a single day. You, their customer (and better still, me, their customer) didn't have to lift a finger.

This is exactly why we farm out infrastructure to companies like Amazon. They have a whole squad of smart people standing around leaning against a post all day every day waiting for something like this to happen so they can jump in and fix everything for us.

My little one-player business has no such team o' dudes on standby. If it weren't for the fact that Amazon is cleaning up for me, I'd be two days into having a really bad time and getting no productive work done.
More run-of-the-mill than tech from the future IMHO. All of the major players already have similar tech in-house, although most of them pre-date docker so they use different container systems.
TFA gives you a clue why you need to know when all ELBs are updated:

* "However, due to nobody outside of AWS knowing exactly how ELB works, this could just mean that the machines currently responding to the requests are patched, but in the next request, it could hit an unpatched ELB machine."

* "We then wrote to support to hear if it was now safe to re-key the certificates, but did not hear from them for hours."

Summary: You re-key your certificates, thinking you are all good. Now an attacker hits a non-patched ELB, exploits the issue and gets your new keys.
OpenSSL isn't a standard any more than winsock. And fortunately, OpenSSL isn't the only library that implements SSL.
I personally use the command line but a lot of my team members aren't comfortable with CLIs so that's why I was exploring Sourcetree and found it to be quite full-featured compared to others I've tried. I've found that Git has so many options, most GUIs barely scratch the surface of what is available.

Thanks for the suggestion though. I'll give Tower a whirl.
Yeah, free software isn't a development model and it doesn't mean it's made by amateurs. As another prominent free project with a much better track record for security and stability, consider OpenSSH, the crown jewel of the OpenBSD crowd, a free software distribution itself popularly renowned for its security. Theo's criticism here of OpenSSL carries a lot of weight.
Anyone who has ever donated to a church is in the same boat. You would be hard pressed to not find someone who hasn't given money to a church in some form, and equally hard pressed to not find a church which is not anti-gay, has not had any anti-gay activity at all in any form.

They are all scum. None are fit to have jobs anywhere. It would be better for those who have been leaders of companies, leading them to prosperity, to burn than let them stay - fire them all, everyone. Yes, you too.

Not just Christianity but Judaism or Islam which are even more explicitly anti-gay - logically anyone who is a Jew or Muslim should be targeted next by the social justice witch hunt.

Edit: Many downvotes! Self righteous hypocrites rejoice! You enable anti-gay hate. You disgust me.
I find the article reads like a complaint against paying the taxes. I'm not certain this is more complicated for the business than the sales tax system in the states - potentially 50 sales tax rates to pay plus more if a city wants to add an additional tax (though admittedly in Indiana I think those are reserved for food and hotels).

The reason the business is required to add in the tax is so that customers are getting upfront pricing that includes the tax. The system is much easier for me - I hated tax sticker shock in the states. I know the tax is there (I'm now living in Norway), but the cost of the tax isn't a shock at the register.

Why does the business have to charge it? Same reason businesses have to collect sales tax in the states. Do they care if you are an American company or not? No, but honestly, the American government doesn't care if you are an american company or not, you still probably have to pay the tax (especially if it starts to be universally required and enforced).
Embedly is hiring a Designer in Boston
This is outdated advice. Whatsapp has since added the feature to their Android and Java apps. If you want to hide your last seen time just update your app to the latest version.

One interesting thing they've done is that if you hide your last seen time you can't see anyone elses either. Pretty clever on their part as it ensures that most people won't do it.
This has some information although not exactly what you wanted to know:

http://lwn.net/Articles/579081/
I suppose it matters to know when the patch has been completed, so that new keys can be generated as quickly as possible.

The overall tone of the post seems rather out of proportions though.
Apart from the economic differences (outlined in Robert Frost's Quora post), ISRO also practised "frugal engineering"[1] by making use of their existing technologies/framework while building spacecraft. For example, MOM is based on ISRO's proven I-1K spacecraft bus[2], and its onboard propulsion system is based on their apogee kick motor[3]. Payloads are completely new and developed specific to the mission.

ISRO's Moon mission Chandrayaan-1[4] cost around $64 million back in 2008. It's relatively "costly" compared to Mars mission because ISRO had to do some groundwork to support such deep space missions. For example, Indian Deep Space Network[5] was built at that time to track Chandrayaan-1; and now it's being used to track MOM as well.

[1]http://articles.economictimes.indiatimes.com/2013-10-31/news...

[2]http://en.wikipedia.org/wiki/I-1K

[3]http://en.wikipedia.org/wiki/Apogee_kick_motor

[4]http://en.wikipedia.org/wiki/Chandrayaan-1

[5]http://en.wikipedia.org/wiki/Indian_Deep_Space_Network
We know from the NSA's own files that they pour lots of money into programs that specifically introduce bugs like this [1]. Do the current batch of leaked documents outline this exact vulnerability? No. Does it perfectly fit the model of what the NSA's own files say they're doing and therefore make it a high-likelihood explanation? I think so. At the very least the assumption that an intelligence agency, such as NSA or GCHQ, is responsible is a useful way of thinking about the kind of adversaries one faces with this type of software.

[1] http://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryp...
The only blind mathematician I ever knew worked with fractals and was able to draw fractals on the computer and then accurately describe what these fractals looked like.
Canada Revenue Agency was affected by HeartBleed
So wait until you see this message: https://aws.amazon.com/security/security-bulletins/heartblee...

and then update your certs again just to be safe.
> Clicking on the OP will force you to watch an obnoxiously, unskippable loud ad about razors and chest-shaving.

I didn't notice it.

> Sorry, don't think supporting an antigay candidate and a specific antigay law are the same thing.

No, but they are kinda close.

> OKCupid's CEO apologized.

That's definitely the big one. Eich should have done that, and distanced himself from the foolish ideas he held in the past.

That said, I think the call for a Firefox boycott was way over the top, and considering OKCupid's CEO's political support in the past, at least a little hypocritical.

> I don't think he gets the benefit of the doubt of, "Well, he just doesn't want the government to be in the business of regulating marriage." If that were the case, then why hasn't he simply said that, as other political candidates have done?

It's an argument that makes no sense. If he didn't want government to regulate marriage, he wouldn't support a law that regulates marriage (which is what banning gay marriage but allowing straight marriage is: government regulating marriage).
If you ever implement connection oriented protocols, you will very quickly find the need for a heartbeat mechanism - otherwise you have no way of telling whether the remote end is dead, or if is just busy creating data for you/doesn't have any data for you right now.

Not having heartbeats, you end up relying only on arbitrary timers to time out your connections, which are far from optimal, or you end up relying only on the underlying protocol which is not enough in most cases.

TCP doesn't provide that for you. (TCP does provide keepalives, intended for other means, they might be a poor mans substitute, but they arn't exposed to the TCP user in a particularly useful way - it's also the wrong layer for this problem)
Are you on Infinity (FTTC)? I've heard various stories about people on FTTC getting slower speeds with anything other then the latest Homehub.
Love it, but when are you expecting to publish documentation?
Agreed that trust is the biggest problem. Specifically, how do you convince major browser vendors they should ship with the root cert for your CA. If that doesn't happen, it drastically limits the practicality.
The Treacherous Land of Undocumented APIs
There's a formalism that we manipulate to reason, but we're always aided by geometric and spatial analogies. The Monster is a permutation group, which means it moves things around, and we visualise 11 dimensions by considering 3 dimensional analogues or by projecting the shadow of 11-dimensional objects onto 2 or 3 dimensions.
TL, DR:

Troy Hunt: ”The Heartbleed bug itself was introduced in December 2011, in fact it appears to have been committed about an hour before New Year’s Eve (read into that what you will). The bug affects OpenSSL version 1.0.1 which was released in March 2012 through to 1.0.1f which hit on Jan 6 of this year. The unfortunate thing about this timing is that you’re only vulnerable if you’ve been doing “the right thing” and keeping your versions up to date! Then again, for those that believe you need to give new releases a little while to get the bugs out before adopting them, would they really have expected it to take more than two years? Probably not.”
Usually I find tabs I want are next to each other, or easy to drag together. If there are a log of tabs in the window that I don't want then I use the Tab Split Extension[1] to put them in another window, or I just edit the bookmarks once I've created them.

[1] https://chrome.google.com/webstore/detail/tab-split/imjbfepo...
Tech Book Face Off: Rework Vs. The Silicon Valley Way
Brian-talks-about-angular-with-lots-of-data
Eco-friendly fluid keeps SGI supercomputer cool and moist
> You would be hard pressed to not find someone who hasn't given money to a church in some form, and equally hard pressed to not find a church which is not anti-gay

You're not looking very hard. Churches vary a lot, especially once you start looking outside arch-conservative US. There are churches that have gay vicars. Lots of churches have not had any anti-gay activity. The WBC is not exactly average.
My favorite: Begin, a Tactical Star Trek Simulation. Its like this game but on steroids. Vast galaxy, a whole fleet in combat on each side, Klingons and Romulans and Orions, many vessel classes! Google it, its everywhere, even Wikipedia.

And I know the guy who wrote it, in fact I still work with him. Tom Nelson, who can craft code like a work of art.

If you like playing these games, I definitely suggest giving Begin a try.

(Why 'Begin'? Because in the progenitor to this game, in BASIC, on an HP2000 there was a maximum code size. Large programs had to be written in pieces and 'chained' together in modules. The modules were numbered but the first was called 'Begin'.)
https://www.ruby-lang.org/en/security/
Sending SMS to phones discontinued on Gmail
That really doesn't illuminate anything, because you'd also need to explain why open source has been spectacularly successful generating other public goods (linux and others).

The economics of open source are pretty clear at this point. The software industry spends a lot of money supporting open source, because it's in their own interest to do so -- it's cheaper to share the costs than to build your own infrastructure from scratch every time, when the infrastructure is not part of your competitive advantage.

This particular bug was found by people that Google pays to audit open source code all day, in an effort to improve said code.
Yeah, that's pretty messy. As an Opera user I had no idea that other browsers used Ctrl or Alt for access keys. That's just a recipe for disaster. Opera's Shift+Esc combo guaranteed no clashes with browser shortcuts, but it was really kludgy to use.
thanks for the input. Will certainly look into that.
Google Checks In to the Hotel Business
I did it by use no any app. Just use airplane mode the read the message. After finish reading message, I turn off the airplane mode.
Looking at the photos, I started to think, is there any young developers who use PCs instead of Mac's, any photo of a coworking space I saw lately shows that everybody is using Mac.
Far worse are websites like Battle.net that hijack the onpaste events to prevent pasting passwords. Hijacking keyboard shortcuts may cause inconveniences but prohibiting password pasting is a security flaw.
It is an appropriate insult when the party you're conducting business is or presents themselves as professional.

It's about the expectations you convey to your customers. If you don't want "amateur" to sting, don't pretend not to be one. Make sure your customers have an accurate understanding of the services you provide and your ability to provide them.
Show HN: BlockCypher’s cloud-optimized, full-node Bitcoin with web APIs
Ladies (calling all Bitcoin women!) & Gents, we introduce our cloud-optimized, complete Bitcoin node built from the ground-up for scalability and reliability. Bitcoin is one of the coolest innovations and we laud the Bitcoin core team. We want to help the Bitcoin ecosystem grow and mature: we are focusing on infrastructure to make it easy for developers to build and scale Bitcoin apps. Our approach allows us to expand to a wide array of unique crypto-currency services.

Check us out on www.blockcypher.com and see our documentation http://www.blockcypher.com/#!documentation/c8im. Check our web APIs, webhooks, websockets, and ‘Try me’ examples. If something isn’t clear, doesn’t work as expected, or if you’re dying for more APIs, please tell us. We love constructive feedback! Thank-you.
You really think supporting homosexuals is a common trait in churches anywhere? "Being gay isn't bad if you don't act on it." Oh, yeah, sure. Totally not anti-gay.

http://skepticsannotatedbible.com/gay/long.htm

Anyone who thinks this book is golden is anti-gay no matter how they spin their politics.
No problem! As a workaround you could probably add a text widget to the sidebar with the link.
Lead Generation System – Using One To Grow Your Business
"The situation is like a prisoners dilemma for hotels. If they all raise prices and none of them break rank in price, then they all make more money."

This is really just competition, with the possibility of collusion, which is very much Econ 101.
Nah, I am extremely pro-Snowden & extremely anti-NSA... but I'm also a person that enjoys programming in C.

C is hard. I really think this was just a bug. What _is_ possible though is that the NSA knew about this bug since awhile back and kept it secret. But then if they knew about the bug, why was nasa.gov vulnerable? I would not expect any .gov domains to be vulnerable unless to create plausible deniability - but this kind of conspiracy logic has no end.
Show HN: Last.fm Dynamic Image Generator
I have experienced issues with several online services, as I expect everyone here has as well. I am impressed with how Heroku handled it with mandatory updates every 3 hours, and handing out clear instructions to their customers and also apologizing when the procedures caused inconvenience. Not everyone handles these things with such care
The Universal Approximation Theorem[1] asserts that you only ever need one hidden layer, which at least asserts that "an (approximate) simplification exists".

But I can't say off the top of my head how you'd collapse an ANN just two hidden layers into 1. It's not obvious how sigmoid functions compose, but I suppose I should give it more thought...

----------
1: http://en.wikipedia.org/wiki/Universal_approximation_theorem
It might be more interesting to treat these things as a memory mapped device, and just cough up whatever is currently there rather than fetching (blocking!) at every access. Would quite obviously have its own issues, though.
I have noticed issues with Firefox shortcuts while on YouTube, and have wondered if this sort of skulduggery was going on.
Calling the team at AWS "amateurs" is a great way to discredit everything the author wrote. AWS is a gigantic infrastructure and they got everything fixed IN LESS THAN 48 HOURS. That is not an amateur response time.

Sorry their updates weren't to your liking but they were responding and posting bulletins the whole time and again: they solved the issue very quickly given the number of clients they support.
> Install on Mac, PC, or Linux...

Am I the only one feeling this is wrong? I know Apple wants their Macs not be called PC's.
But a distinction between PC and Linux is something new to me.
Loved this line of code:

NSString *networkPath = ....

if (networkPath == NULL) { // <- :)

Cheers!
"Local HDD can already have access latency similar to the local network!"

Right, there are situations where "in RAM on that other computer" is closer than "on my disk".
It's a fair jump from "Anti-gay" Church to WBC. So you go to a hippy church, that's great. You said it yourself, churches vary a lot but most side on the homosexuality being a bad thing.
Do tell, how is that a "security flaw"?
very few people are going to install the extension

My argument is, pinning certs is a bad reason for removing the root certs from the browser, since you can pin them without breaking the CA chains.

I'm not sure how does that work as a counter-argument; We're discussing a decision of a particular person, not some broad policy. How is the number of people who install the extension relevant?

those that do might not even notice the message because it notifies the user so frequently (fully desensitizing them I imagine)

So does the browser, if you remove the root CA certs.
> open source has been spectacularly successful generating other public goods (linux and others).

No one doubts that some open source software has been very successful. What I'm not sure of is whether levels of open source provisioning are optimal: maybe there should be 10X what there is now. Maybe Linux should dominate the desktop world, but does not due to lack of funding. This is Bastiat's "what is not seen" - what we have now is good, but perhaps it could be better. Maybe a lot better, under different circumstances.

Also, that link mentions Coasian solutions, and privileged goods, which between them explain a lot about open source software, no?
The Heartbleed Bug: what non-nerds need to know
I find this remark quite funny from someone who is using C to write a "secure" OS..
TBH I would say they are "ok" at integrating products. Until last year I worked at a company that used Atlassian products, and while they worked well together there were definitely a lot of points of integration that were missing which we felt should have been there. It's been getting better over time, but it's definitely not seamless.