skysight-inc/HackerNews huggingface dataset:
> I have no willpower to do anything in any of my non-major courses.

If you're not motivated enough to buy textbooks and work through them on your own I'd suggest looking around for a trade school that will allow you to specialize in programming. Your coursework will be pure programming.

> I want to just work on something for someone.

As a sophomore it is unlikely that you have the necessary skills to do much of anything for anyone, software-wise. Why not start a few projects of your own and learn as you go?

> Living at home is the last option I want to explore.

It's probably your best option, in my opinion. With your lack of coding skills its very unlikely that you'll be able to find a programming job, leaving low-paid, low-skilled jobs as your only other option. Working a 9-to-5 is tiring and it will be very hard to find the motivation to come home from work, study, and code. Why not live with the parents for a few years while you teach yourself how to program? Free room and board is a pretty sweet deal.

> Is there some sort of person I can talk to about how to go about getting a job

There are always mid-clients/recruiters and monster.com, dice.com, etc. With the little amount of programming skills that you have, no real resume, and no portfolio it will be difficult.
> Having read through RFC 6520, I don't understand why the payload is necessary. Neither the server nor the client appears to be using it for anything?

RFC 6520:

"To perform PMTU discovery, HeartbeatRequest messages
containing padding can be used as probe packets, as described in
[RFC4821]."

"In particular, after a number of retransmissions without
receiving a corresponding HeartbeatResponse message having the
expected payload, the DTLS connection SHOULD be terminated. "

"When a HeartbeatRequest message is received and sending a
HeartbeatResponse is not prohibited as described elsewhere in this
document, the receiver MUST send a corresponding HeartbeatResponse
message carrying an exact copy of the payload of the received
HeartbeatRequest.

If a received HeartbeatResponse message does not contain the expected
payload, the message MUST be discarded silently. If it does contain
the expected payload, the retransmission timer MUST be stopped."

The "use" of the payload is in the RFC. What the RFC omits is the "why" for why the payload exists in the first place. Omission of this "why" is likely because the authors expected that their readers would inherently understand why given that the RFC is for network protocols and meant to be read by those understanding network protocols.

The "why" is that networks are subject to packet loss, and to timing delays. If you send out two heartbeats 10s apart, and only receive one reply back, then is the reply responsive to the first heartbeat, or to the second 10s later? Without some unique data in each of the packets you send, which is echoed by the other end, you can not disambiguate this question.

Now, one could argue that a simple sequence counter defined by the protocol would suffice. But that is open to exploit by a misbehaving server because once the server recognizes your heartbeat counter pattern, it can issue anticipatory heartbeat replies with the proper sequence number that you will accept as valid. By making the payload arbitrary bytes, then you have the option of sending a sequence number, or generating random data (and tracking it yourself), or both. The random data aspect thwarts misbehaving servers from determining your pattern and replying with the right data without ever receiving your requests. The arbitrary sized payload also makes the packet useful for path MTU discovery as the first paragraph I quoted from the RFC indicates.
I need a good book on emulation, i wan't to write an old console emulator.
Anyone know a good material for that?

Thanks
Seriously, a badly designed dropshipping ecommerce? :-S
Even the name "Heartbeat" sounds like something NSA would name it.
Google launched Google glass at Work
A Hack That Makes Bitcoins a Whole Lot Harder to Steal
X-BOX Hacked by 5 Year Old Child
I'm not aware of any books on the topic.
"the absence of evidence is not the evidence of absence"

http://en.wikipedia.org/wiki/Argument_from_ignorance
Bravo. Good on you for taking the leap.

It's a tough decision to make, when the getting is good, to step away from all that good getting. The temptation is so strong to just let it ride a bit longer and build up the stack. Especially when you have a family, house, etc. that might really appreciate having a nice pile of cash in reserve one day.

The problem is, the longer you leave it, the bigger the pile you "need" becomes. One year's expenses isn't enough anymore; It should be one year's worth of your current earnings. No, maybe three years of earnings 'cause you never know. Or come to think of it, maybe I should pay off the mortgage, then sock away those 3 years of reserves.

A lot of guys never step back and say enough. Hats off to you for doing so!
The Evolution of a Software Engineer On Coming Full Circle
I've had many more problems with AA in the past. (Like Styling, simple_form) I quite speedily dropped AA in favor of building my own AA backend, which is not that hard...
AA consists out of a lot of stuff that you can just as easily put in your Gemfile.
like inherited_resources, has_scope, devise, cancan, kaminari in favor of AA's will_paginate, and ransack.

I'm currently happy not to be on AA, it seems it would have held a lot of development back. AA ties you down to a lot of stuff that might break in the future.
I think it's a great gem if you're starting with rails or need a quick admin backend of your models (when your site is mostly frontend). If you're looking for a true backend that needs some degree of custimization I woudn't risk it.
I had the impression that the Win2000 code he's talking about was the leaked source code.

I didn't know the Microsoft source NDA was so evil though; good warning. :)
Ok but is there any evidence that anyone has a practical use for distinguishing the order of received heartbeat response packets? Otherwise it is still a complete YAGNI feature. And if so, why wouldn't a simple 32 bit sequence number suffice?
Risk management and security is two sides of the same coin.

Lets make an analogy of an investor. If person invest in a single company and it goes bankrupt, the investors might loose his roof over his head and the food on the table. This in turn effects his personal security.

In order to mitigate this risk, he uses risk management to diversify his risks. He might not be able to spend the same amount of time per investment and this increasing the general risk, but high risk events like bankruptcy is spread out and is unlikely to cause a large impact.
I'd suggest going with node.js. Lot of libraries, large community. Fast and easy to get started You are going to have to learn javascript on the frontend anyway, might as well use it in the backend.
Heartbleed leak : pins of every credit cards are in the wild
David Nolen – The Functional Final Frontier
Replica Kd sites
There was some previous discussion at https://news.ycombinator.com/item?id=7189886
"40-60fps on phones, tablets, PCs..."
>klicks a button
>site doesn't react for 2 minutes
>laggy background animation
>on i7 2.7GHz Laptop (AC adapter plugged in)

Either I'm missing something, or this is absolutely ridiculous.
The performance problem is because of the abstraction level, we're too far away from the metal with DOM/JavaScript. This can't be solved with JavaScript.
Bud – TLS/SSL Terminator invulnerable to Heartbleed
I'm assuming it compiles to native code on mobile.

BTW, I have a shit computer and the site ran smoothly for me.
Sounds like you learned all your lessons in one go. Well done.

Never take a pay cut in exchange for lottery tickets. Check. Never take a pay cut in exchange for a vague promise of returning to your real rate later. Check. Never let anybody position your market value in the context of what another developer has negotiated for himself. Check.

You got all that out of the way in the first year. Time to move on to that better job that pays you in money. Bet you'll never make any of those mistakes again.

Good luck!
I don't think this is crazy at all.

We use something similar as this internally as well, which we custom built to our needs. Instead of Serf we use Zookeeper/etcd though.
How will it 'preview' the sent mail?
E-mail clients behave differently when it comes to layout.
When I'm doing such testing, I still verify the mail in at least the top 90% tier e-mail clients (web and desktop).
My attitude towards complaints about open source projects is that if you think the errors are rudimentary then just submit some patches. If there is not enough test coverage then add one. This applies especially if you believe that the project is critically important.

I think what might be happening here is expert syndrome. People may be told that if they're not experts then they shouldn't be reviewing or changing the code.
For TLS, which runs on top of TCP, this is a non-issue, as TCP enforces complete, in-order delivery of the data.

However:

This document describes the Heartbeat Extension for the Transport
Layer Security (TLS) and Datagram Transport Layer Security (DTLS)
protocols [...] DTLS is designed to secure traffic running on top
of unreliable transport protocols.

The payload is necessary because this extension can be used with DTLS, which runs on top of UDP, which does not enforce complete or in-order delivery.

I wonder if the payload should have been specified only for use with DTLS, not TLS.
Internet users advised to change passwords due to 'Heartbleed' bug
5 Interesting Things to Know About HTML5
Ask HN: Did you test for the heartbleed vulnerability without permission?
Checking services for vulnerabilities without permission is quite likely illegal in many countries (UK in particular). Did you knowingly break the law yesterday testing for it?

Do you think it should be legal to do vulnerability checks like this?
There is large body of work from the mid 1980s and early 1990s that addresses the question of hardness, sensitivity and robustness from various statistical physics/computer science collaborations. Of course, it is still ongoing, but that was a big period. The basic thrust of this program is to take methods from statistical mechanics and use them calculate not just worst case complexity, but also average case, best case, and everything in between. It is hard to think of a reference to end all references, but as far as books go you might want to check out: http://www.amazon.com/The-Nature-Computation-Cristopher-Moor.... For an article that briefly addresses some results related to kSAT there is: http://www.cs.cornell.edu/selman/papers/pdf/99.nature.phase.....
> How everything is made, on purpose, needlessly complex to
prevent honest developers from working on important things.

Developers are quite willing and able to do this all on their own. Feature/scope creep is pretty horrible these days.
Is Antitude going to be a commercial software?
Here's another interesting bit: Up until now it is still required by law that apartment buildings are built with a nuclear proof bunker underneath, including air filters. There are in fact more bunker places than people in Switzerland, i.e. >8M. These bunkers are mostly used as wine cellars and storage rooms now. Also, most of the soldiers take their rifle home and store it, even pass it to their sons. This thing is basically a sniper rifle nowadays, precise for 1300f without scope, 2000f with scope.

But, see, the biggest effect this has is not in scaring off foreign powers (which hasn't been relevant since WW2), but on the people's mentality within the country. The government is seen as the people's employee. The guns at home, the banking secrecy and the direct democracy are in many ways instantiations of this thinking. Politicians wouldn't even think about trying to pass laws that are unpopular. With the tools given, a resistance movement would be very difficult to fight against - it's like a Sword of Damocles hanging over the country that has become so natural, no-one even thinks about it. On the other hand this situation has never materialized since the republic was founded 170 odd years ago, even though there are multiple minority ethnicities - the people's political power with the Referendum is enough to keep everyone content. Majority decisions are true majority decisions.

This country is like a lab, showing that a democracy can be stable, prosperous and peaceful for a long time - if only other nations would recognize the lessons that could be learned from this.
It displays a completely different site on chrome than on firefox for some reason...
Java has nothing to do with it. Untrusted input is untrusted input. Any moron can figure that out.

OpenSSL, no code review, no tests, and bad code.

Why are we responsible for finding these bugs?

And no just FYI my code has no bugs
I love my lunch break, lunch isn't just about eating.

The price aspect can be interesting , but I really don't need an excuse for my boss to get rid of my lunch break
There is no single NDA, all NDAs are different. The NDAs I've managed to negotiate regarding this issue have no such clauses.

That being said, you are right that this is a valid concern and people should be careful.
See my other comment - the parliament building is pretty much meaningless if a foreign power wants to 'take over'. It's not impossible of course, but it would be prohibitively expensive, as in Afghanistan times a factor X. Using the current situation in the Middle East as an example, one should recognize that a simple 'invasion' is far from taking control over a region.
I would assume the NSA always assumed (note past tense) that their secrets stay pretty secret, and their wide-open backdoors will not get knockers.
Since their own (status.heroku.com and heroku.com) certs are from 2013-10-03, this illustrates a bad situation post-heartbleed:

Were they using a 1.0.1* vulnerable OpenSSL, or not? or did they (unlikely but possible) not adequately fix the issue.

This is information only the service provider has, and thus poses a dilemma (in terms of transparency at least).

Here's hoping for the best.
In this post-Snowden era I believe Occam's razor yields a different result about NSA interference.
Straight to the meat: http://pdos.csail.mit.edu/6.828/2012/xv6.html
I may be biased in that I have not written much C-code in years (decades?), but whenever I find a codebase covered in IFDEFs, I start assuming that every single new IFDEF introduces a new condition into the system which has not been properly nor recently tested, and that the software is horribly broken.

For me, fixing software, is just as often removing IFDEFs together with unmaintained and broken code. It's IMO much better to be honest about "this isn't supported", than pretend you support something you don't.

And this seems to be another one of those stories, coupled with a (bad?) case of NIH.
I posted the 'public good' link elsewhere, and this goes to the very heart of the problem: why should I pay if someone else might, and then I get it for free?

There might be a bunch of companies willing to chip in a bit, but coordinating that is difficult. Something like kickstarter might be able to help, but that has its own problems: if you spend your time writing a commercial SSL thing, you can go out and sell it right now when it's ready. If some company has to wait around for the results.... it's not as nice for them.
António Segadães Tavares Aspetos de Projeto de Estruturas de Edifícios
Has that been audited independently? A quick Google search didn't cough up anything.
In order to implement a defensive stance, a nation needs to be independent in the first place. It takes years even under the economy of a war to implement a defenses like this - more than enough time for a world power like Russia to prevent it.
World's most photographed locations
Properly implemented crypto takes a constant number of instructions to encrypt/decrypt, regardless of key, plaintext, etc.

Time to sleep() would vary across processors, os-es, and even load (!), so it's not exactly a workable solution. Not to mention it would be grossly inefficient (Context switch on every crypto primitive? No thanks).
For anyone interested, the Lisp Machine OS was called Genera:

http://en.wikipedia.org/wiki/Genera_%28operating_system%29

Fascinating thing.
Shift from cash to card payments has cut crime by 9.8% since 1990
Something that compiles to C? Or can compile to C at a slight performance penalty for unsupported platforms?
Some more information: https://docs.google.com/a/famo.us/document/d/1aC461kM855a66S...

and https://docs.google.com/a/famo.us/document/d/1DE_26fh9nYbU2x...

Source: https://twitter.com/befamous
Because that approach is fantastically irresponsible and existing companies don't want the legal hassle.
Even if you work on a commercial project, where there is a reasonably stable core team, people just committing stuff, even if it's in itself pretty good stuff, won't result in good overall code quality. You need to have a systematic process, including a detailed coding standard, requirements about test and documentation coverage for submitted code, precise guidelines for contributing, rules of code review, and you need people who understand the whole project, review pretty much all of the code changes, have an overall development schedule in mind including refactorings and technical improvements, and all the time putting work into maintaining overall integrity of the project:

http://c2.com/cgi/wiki?ConceptualIntegrity

This is pretty much a must for any project where there is more than one person working, and the more people contributing or the more mission-critical the project the more of this kind of high-level coordination is required. Some open source projects with strong leadership do get to this kind of integrity, but most don't. It's easier when there is a relatively small team of very dedicated individuals, but some large projects have succeeded to some extent in building a real development culture in an open source setting, like Linux.
physics simulations like that in EVE are far from embarrassingly parallel. Especially because the 'balls in space' physics simulation needs to be deterministic and synchronised between server and client.
BlackCoin Popularity and Value Soars Due to Revolutionary Leading Edge Features
Gamification is great, but from personal experience I find it only works when I'm already engaged. e.g. I'm interested in what's going on HN and the karma points help motivate me to contribute, or get a sense of whether my comments are valuable to the community etc. Same with StackOverflow etc.

Gamification won't convince me to do something I'm not already interested in doing, and to some extent, even things I would like to do (e.g. learn a new language), but which are hard - gamification helps, but won't be enough to keep me learning.

That's just my personal observation. I do not know if it applies to others.
the lesson: general and up-to-date understanding of larger systems is sometimes required to make the most innocuous changes.

be a generalist
keep up on current technologies
HBO's Silicon Valley is funny even if you work for a startup in London
A very fast history of cryptocurrencies before Bitcoin
I played this on an ICL One Per Desk (http://en.wikipedia.org/wiki/One_Per_Desk), sometime in the mid-80s. I loved it.
What great products have degraded over time due to feature overload?
As soon as "open source" looks like a sloppy blow job everyone as in "idiot brogrammers", hey man, "I dont even work here", walks away and goes its SO hard...so HARD.

Fuck you, you are a bunch of juvenlie misfits of the HIGHEST order who should not only never maintain security software,
but get a real estate certification.

Fuck off and die you 20 year old loser idiots
Siemens And McAfee Team Up To Provide Security Solutions
I absolutely depend on some swearing to draw a clear line between the factual presentation and everything else. I think this is why beer:30 and stepping away from the office with coworkers is important.

People matter. The way software makes them feel matters. Code smell and related concerns are best conveyed in profoundly human ways. Fuck it. Say it like you mean it.
Ignore people who say that.
Crypto doesn't need to be complicated.
Here is the patch Theo is talking about: https://github.com/openssl/openssl/commit/8671b898609777c95a...
Huh. That suggests a strategy for a viable OpenSSL replacement: create a new protocol implementation that also links to the OpenSSL libraries only for the cryptographic primitives.
What would it sound like if it were named to indicate signs of life?
Theo is such a "character" that his "work" has been incorproated into the plan9 spin-off 9front as a theo (1) specific fortune file.

http://man.cat-v.org/9front/1/fortune
Stop posting this xkcd. Seriously. It's not funny, it's not witty, it's old as hell and it does not make sense.
With just my eldest, 10-yo daughter, I have subscribed to 9 mailing lists at 3 different schools in two countries, to discuss things with various groups of parents, with none of these lists being started by tech folk.
You end up with a LOT of hidden or visible markup, redundant on both mobile and desktop.

After working on responsive websites for about 2 years now, I feel that variants is the way to go with Mobile designs.

You flesh out something lightweight for mobile and then another for tablet + desktop + whatever.

Otherwise your mobile display is needlessly large.
Cats often die from renal / urinary problems and cat food plays a large role in that.
I would post this too, it is nice concepts, but it seems stopped, at the most important place, process managment. It would be very nice to complete it.
Not him, but someone else did: https://github.com/openssl/openssl/pull/58
You're supposed to do the initial testing on the 'preview' and then actually test on real email clients.

Colors, fontsizes, margins, etc. on preview to get it right - then email clients to perfect it.
Ask HN: Solutions for Slow Downs with Wordpress 3.8.2?
Anyone else experiencing slowdowns with their Wordpress site today after the 3.8.2 update and if so, any solutions for this problem?
You can imagine a language that's memory safe. In fact, these languages exist today.
The backlash to the Comcast merger is now bipartisan
What people want and what’s good for them
Just as a datapoint: raising their next round might be easier if they have a CTO in the US. You could be that CTO. But also, look for another job.
Instead of just testing one supplier, I tried to ask them about their own assessment. It was a very frustrating experience and took 30mins of faffing around and the only answer I got was they hadn't heard about it and were going to look into it (they were a large company btw, other departments of which had issued statements).

Compared to just checking it with a script that takes several seconds to run, this was pretty ridiculous.
It's not even close to "banning gays". It's a restriction, sure, and it's a stupid dumb one that many countries have or have tried in the past but Russia isn't "banning gays" at all.
Au contraire, crypto developers probably should write their own memory allocators (just, you know, not quite so badly,) otherwise they're open for timing attacks.
Last year I took part in a similar project in which I had to issue both server and client certificates, signed by another certificate, for a company's sales site. I'm not by all means an expert in cryptography (not even close), and after googling around a bit I found "The Legion of The Bouncy Castle"[1] crypto library, which was relatively easy to work with, and enabled me to solve my problem quick enough. I just wonder what more experienced programmers have to say about this crypto library.

[1] http://en.wikipedia.org/wiki/Bouncy_Castle_(cryptography)