skysight-inc/HackerNews huggingface dataset:
I agree with you that open source does not automatically lead to better software.

Now that you've clarified you weren't talking about RMS's "free as in speech" ideology, I retract my nitpick.

I wouldn't say open source doesn't matter in regard to quality and security, though, but I agree with you on the importance of the other factors you mention. I do wonder what would have happened with a similar bug/exploit in a piece of commercial software. Who knows? Maybe it's already there and we simply don't know about it, and there are fewer people looking at it.
If the passwords were POSTed over and left on the heap, then they were vulnerable to being scooped up via Heartbleed, even if they are stored hashed in the database.
Still, Amazon Instant Video seems like a no-brainer. Get that on Google Play, stat! Please...
Who is Robin Seggelmann and did his Heartbleed break the internet?
Is German computer programmer Robin Seggelman a man who would purposefully leave a gaping hole in the internet, which the National Security Agency could have been exploiting to spy on people's communications? The Sydney Morning Herald explores his past and finds he has published a number of papers, including a thesis on strategies to secure internet communications.
Perhaps they're using the etymological root of aware, which is "wary", and they mean they were unconcerned with its existence as they were unwary/unaware of any possible dangers with it since it was unknown to hostile forces.
The book alleges that the HFT firms actually lobbied foreign countries to open new exchanges some distance apart from their existing ones, precisely to allow for inter-exchange arbitrage.
I'm pretty disgusted that this comment has become the top post over the comment from pxtl about cars being the leading cause of death for people under the age of 35. Driving is a privilege and many hear are actively trading tips on how to abuse that privilege and get away with it.

I would hope that one day we have RFID chips in speed limit signs that cars can are obligated to read and electronically limit the speed of the vehicle.
Ask HN: Would you do video calling to practice a language with a native speaker?
If you say no, please explain why!
Wow thiat turned out to to be something different from what I was expecting. I cringe every time I hear (or read) the words "Let me know how I can help" because that was the SIGNATURE phrase of one of the most useless, incompetent people I've ever worked with in my life. Nearly every email and converstation with this guy ended with that phrase. I now view it as a throwaway line of someone who doesn't have anything really helpful to offer.
https://twitter.com/eastdakota/status/454792635279220737

Pic of the CloudFlare team reviewing the attack. Ten guys crowded around one monitor.
I thought they were a Redhat shop. In which case, far far too late to change course!
> Big investor. If you are a retail investor, the HFTs don't know about you until after your 2 lot trade is finished.

Doesn't that obfuscate the fact that most retail investors interact with the market via various funds and intermediaries - which in turn collectively makes them a "big" investor?
In this case, you're right. I don't know that I would make a general rule out of it, though. Maybe in general open source helps, but in this case (for several reasons, including that OpenSSL seems to be a barely understandable mess, or "written by monkeys" as some put it) it didn't.

I agree that thinking "open source magically makes software better and more secure" is absurd. I also agree that Jim Zemlin's statements (in general, in that article) are more of a PR thing than accurate statements.
This is just disgusting; these people should be thrown in prison.
Many big investors, e.g. mutual funds, trade on behalf of retail investors, so everyone is screwed. That was one of Lewis's core arguments in the book.
What I'm saying is that we should be looking at (open) alternatives to OpenSSL, like GnuTLS for example.

It's not about open vs closed or "all code has bugs", it's about the OpenSSL project needing to rethink their security strategy and general guidance.
http://www.youtube.com/watch?v=dnLYoMIBhpo
they died out by spending too much time on hacker news
Maybe their women found homo sapien men more attractive.
Sounds neat. Any word on what OS it's running?
Anyone here run a SSL certificate provider? Just make a new line of certs that cost 3 times as much but donates the overage to OpenSSL.

Lots of corporate IT people can get away paying $300 for a cert and know $200 of that is going to a good cause.
If they did know, they would not admit it.

Maybe they didn't know. But we certainly do not have the right to know if they did know or not. This means something.
As pointed out below, even if you are not authenticating or transmitting data through sign in, you would still like to know if you are talking to the .gov site. Also, while they use SSL for authentication, they don't clarify via banner.

Moreover, the login is for attorneys representing businesses, so there is potentially even more at stake. Yes, they would like to know they are actually talking to the .gov site.
Billy Beane still hasn't been to a World Series let alone won one. Michael Oher was illegally recruited by an Ole Miss booster who skirted NCAA rules by adopting him.

Michael Lewis is Malcolm Gladwell with normal hair. He does seem like a solid guy who really knows what he's talking about. That's how he sells books.
Galaxy is slowly, but surely, becoming a more helpful tool. At this point, I think most people are using ad-hoc playbooks and homegrown roles. I think more people will start using (and improving) Galaxy roles as the tool becomes more mature (most of the glaring bugs are gone in Ansible 1.6, which is coming soon), and more roles are added/shared.

It's nice being able to put together a plethora of servers within seconds, and start deploying them to DO, AWS, or a local box for playing around within a few minutes! See, for example: https://github.com/geerlingguy/ansible-vagrant-examples
ETL: Don't Build Bridges to Nowhere
Server: Microsofg-IIS/7.0
Set-Cookie: ASP.NET_SessionId=...
X-Powered-By: ASP.NET

Thus, it is SChannel.

And the title is wrong--the site says "Did not use OpenSSL".
Really? That sounds like something you would get in trouble for in most places.

It's not for the IT employee to effectively give away the companies money by buying something for more than they have to spend.

The decision to donate to a good cause is usually made by other people in the company.
No one is arguing that all HFT firms are bad. But the ones who give kickbacks to exchanges to fulfill orders at worse prices aren't doing anybody a service.
Could you elaborate on the github permissions required if I sign in via that method? Write access to all public repos is what I'm interested in particularly.
There are any number of possibilities, all of them seemingly more likely than the "Boskop Man" theory. Hydrocephalus. Deformities. Even intentional cranial manipulation to produce specific head shapes.[1]

Cf. the "Starchild" skull that conspiracy theorists still love to speculate about, long after it was shown to be the skull of a hydrocephalic individual.

It's not impossible that this was a lineage of large-brained hominids, distinct from our own. Evolution favors local optima; it does not follow a teleological pattern. If big brains weren't advantageous to the local circumstances, they wouldn't have survived. But the big-brained, distinct-species theory speculates quite a bit on very little evidence.

[1]http://en.wikipedia.org/wiki/Artificial_cranial_deformation
Indeed. They could clarify rather easily. Not using OpenSSL doesn't imply that they are secure, nor does it explain what they are using for the non-technical attorneys on the site...
With fava beans
IEX does neither. They introduce artificial ~350 microsecond delays on their orders, among other things.
Excuse me?

A prominent member of "Anything"?

A regime that invaded another country under false pretenses resulting in the death of of at least 100,000 thousand is just "Anything"?

That's just "small potato political differences" to you?
Regular people go somewhere then park. Cabs drive around in the same areas over and over, contributing to localized smog.
Security researchers do find and report buffer overflows in closed source software, which then get fixed by the manufacturer. It happens.

But yes, I also wonder about the balance of bugs in similar open/closed source software.
a service for creating simple wedding invitation pages with a unique URL. no ads or sponsored links
Are they advocating that we should not pay for movies and such as well? Read:

"No Federal agency should use taxpayer dollars to purchase a report from the National Technical Information Service that is available through the Internet for free."

It doesn't say 'legally' in there any where in there.

Anyhoo....
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello Adam!

My email is public: fedor@indutny.com , and here is my proof of identity: https://keybase.io/indutny .

If you wish - you could contact me via it.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJTSJ7IAAoJEPsOEJWxeXmZYnkP/1r9qVARb89x2bAteh9RPcRI
VGUmRZVz/1wLqy/LmvB+XwgkEGRyjQBCa2vHPi8PpwenLEl8IXMMYyzQSqx94tkV
y54ZTwABtXXcPIaFOu4O8sG8RM6rDVsF9FpJICVxuYzrkyQPVDMEFa3faBNEgTHo
zpgOf5keNq3nCnhTwhkMryBzYVVMLUdQy6JUzhzOXTarmgNH5CtRW0CzFN+9sxM9
6/EH1W4VcJt0lpcvCQK75Kv9syrbavB6qXP85b0gSvKcMHvkX0z5dPphUJcyL/9Q
QyXE2vloNj6qwjLQRPoCymSjePeQsodhec47iQxVgil72U5X4YFYJpDHurE5KVOb
VIGjmiXhAcL7M8MgywNNtP9iIsi45WiOBmNQVYrBr3/37TSL6FFMfpFVuOxxVrNV
fRKRx7VFihTyYxqacwBLAkNPQ6V4QiEdEt74DQFZsokgk1dcchP4GrSypNbrM4SX
SJW0RwqF1t44mvuAHmt0U6otgzKy4XyjmDGvki6FNE8ww+OIEQX6tgRPSTD0bURn
PyNtZ1EKYZguQt3b4pveVK8JMgWxuCcO9LgKFbPTZJ8YBYOTCU6WtTm4OfCdnTG7
1EtOv6c2k5nlOiK11K8M9ZPEkjq//6C0MZFn1CB7/43+tkWDTr/vSayW/6Yi8pF5
/C1vMZXz3MmpY/gj9z+W
=mH1/
-----END PGP SIGNATURE-----
That's strange logic. Whatever happened or not with Billy Beane, he's absolutely right about the HFT-bank-broker strategies that he singles out in his book. Most of the critics of the book seem to not have read it, sadly..
LOL I have that issue
Nice work!

https://twitter.com/indutny/status/454773820822679552
possibility of re-prosecution? definitely possible. I linked as close as I could, but check out the section on non-final judgements: http://en.wikipedia.org/wiki/Double_Jeopardy_Clause#Retrial_...
* From https://www.cloudflarechallenge.com/heartbleed *

So far, two people have independently solved the Heartbleed Challenge.

The first was submitted at 4:22:01PST by Fedor Indutny (@indutny). He sent at least 2.5 million requests over the span of the challenge, this was approximately 30% of all the requests we saw. The second was submitted at 5:12:19PST by Illkka Mattila using around 100 thousand requests.

We confirmed that both of these individuals have the private key and that it was obtained through Heartbleed exploits. We rebooted the server at 3:08PST, which may have contributed to the key being available in memory, but we can’t be certain.
If that was all they were doing, that'd be fine. But read the book.

Some exchanges have 150 types of orders that are mostly undocumented and unknown to most regular players, created specifically so that HFT can not do what they publicly appear to be doing, or take incentives without providing liquidity, etc. The public price that everybody seems is outdated compared to the private prices that HFTers see, so they can risklessly front-run people because they already know if a price has dropped or rise, etc. All that stuff isn't just fast market-making.
It does not. check out the section on non-final judgements: http://en.wikipedia.org/wiki/Double_Jeopardy_Clause#Retrial_...
htop project need you
They may have had a philosophy of nonviolence and were slaughtered by violent humans.

They may have been too gentle to kill another humanoid.

Or if they fought back, they may have been massively outnumbered by humans.

Obviously, humans love to kill and wipe out entire species. They may have had an agreement of peace with the neanderthals and then simply lied about it and killed and tortured them all. They may have raped their neanderthal children, which would have led to the gene transfer.

update: I'm sorry if I've offended anyone. Humans don't rape. I take that part back. And humans aren't that violent (except against native americans, maybe, which is pretty minor.)
Nah, having a "summer break +" that's extended a bit longer ;). I plan to do a crypto course at some stage.

+ Southern hemisphere
I don't understand this response. To be clear, I think web development is fun. I very much enjoy it and don't resonate with "keeping my head down".

I guess to reiterate my point: once you've done web development for a couple years, coding most websites is less about solving new problems and more about applying known solutions.

To reiterate how this point relates to the question of coding interviews: in as much as they don't test for lots of known solutions, and the ability to apply known solutions quickly, they aren't filtering for productive coders.

How does your response relate to the points at hand?
That sounds like it would make a great blog post (or 2). Would you consider posting about your experience somewhere?
I have not seen any reasonable way to decouple having a speed advantage from electronic trading. IEX is a large step backwards towards closed networks of non-public markets.
Law of large numbers. This is not surprising.

EDIT: Law of large numbers. Not central limit theorem. I blame alcohol.
Heartbleed doesn't give you access to storage - it gives you access to the raw heap of the process that's linked to OpenSSL. Passwords are typically transmitted unhashed, albeit encrypted by TLS, and the application decrypts the TLS stream to heap, which means an unhashed version of the password is in process memory for some amount of time. An attacker using Heartbleed has a chance to see that memory, and could therefore see hashes OR unhashed passwords.
Hah! That's awesome. Gotta love the Sierra Nevada on the desk too :)

edit: now why in the world is my comment being downvoted?
Isn't a capacitor charged, by definition, to whatever charge is required by the voltage across it?
More details added on the page: "... by Illkka Mattila [of NCSC-FI] ..." (The National Cyber Security Centre Finland).
Clapper always had the option to decline answering a question. Choosing instead to lie means something.
Where the Price of Freedom is Jail: Pics from Kabul’s Central Women’s Prison
The quotes from HFTs are NOT inferior to existing quotes. At worse, they are identical to the best quotes already available on that exchange.
> My issue with this bill is that it ignores the crucial function of NTIS as a library.

Insofar as that is a critical function, the bill allows the Secretary of Commerce to declare it as such and, provided the Comptroller-General finds that the function isn't duplicated elsewhere in the federal government, transfer the function to another office within the Department of Commerce. See Section 3(b) of the bill.
This has been my experience in my industry outside of Silicon Valley.
I don't understand this argument. There is already a SQL standard. Start there.
More like someone missing the nail and nuclear explosions happen in another part of the world.
No.

The conversations are awkward.

Cambly and Verbling are interesting startups.

I've studied a lot of languages.

Arbitrary conjugation logic prevents any sort of resourcefulness once you've exhausted cognates and repetitive conjugations.

http://kumar.vc/2013/01/27/language-learning-is-broken/

I believe the solution to language learning rests somewhere in providing a viable way to learn arbitrary conjugation logic at an aggressive speed.
The capital G is not (even insofar as any text in a Bill is) originally written by "our representatives", its in material directly quoted from a GAO review.

Unless it inaccurately presents the content of that review, it doesn't say anything about the author of the legislation, except that they quote properly.
Um, what? If anything, applying the theorem in this case would say that profits should be normally distributed, whereas it's fairly common for market makers to have perfect/near-perfect trading records.
And another possibility is that the large brain size just didn't result in greater intelligence or a larger amount of the right kind of flexible intelligence. One could guess that humans need a properly designed brain to behave as we do, not simply any old larger brain.
Undocumented? http://cdn.batstrading.com/resources/membership/BATS_FIX_Spe...

The "public price that everyone else sees" is the same price as the HFTs see. These are available on the direct feeds from the various exchanges, and there's no discrimination against non-HFTs. Anyone who pays for it can get it. It's an equivalent advantage to having a Bloomberg - more data, faster.
Or "Notification and Federal Employee Antidiscrimination and Retaliation Act".

Does legislation that can't be summarized in a clumsy acronym ever get passed? I can just imagine cabinet meetings: "Sure, world peace is a nice idea, but we can't think of terrible enough acronym for it, so we've decided against it."
> the ability of some insiders to obtain an advantage over the ordinary investor.

What are you talking about? Who are these 'insiders'? Anyone is free to build a trading system that uses speed as an asset if they have the will and ability to. Speed of information used to be considered a noble thing for traders to invest in.
Naval Warfare with JuMP + Julia
>Out of the top of my head the only thing that makes '\0' terminated strings special in C is that it's the way string literals are represented. It would be trivial to recode all of string.h using addr + len instead of nul terminated.

exactly, anywhere you would have
if(str[i] == NULL)
you replace with
if (str.s + i == str.end)
Much kudos to the guy who cracked it later in the day. I'm glad this proved a useful test. I gladly stand corrected.
I think it's a good idea. Cert prices vary, and there are reasons for it, and companies would rather pay for stability than save money.
i don't know about that. considering the n=1 on intelligent species on the planet (perhaps ever lived) and every other species (that has ever lived) is not intelligent, it seems like we would be an accident.

evolution seems to favor volume over quality, not to say there aren't exceptions but roaches and rats seem to be doing pretty well.
Sorry, that was vague. My point was that market participants who make many trades will rapidly converge on their mean return, with little fluctuation. If you sample a normal distribution 10M times with a mean of 0.01%, you will very rarely see a negative sum of the samples.
it should hve made it easier actually, because with pointers you are usually just doing addition subtraction, and everything should be independent of the acutal value of the pointer.
They could join another nonprofit.
Also interesting that we had digital data storage, in the form of punched cards and tape, decades before digital computers.
Tangential question :

What are the barriers to entry to HFT?

Or, put differently - how well funded would a venture have to be to realistically compete in this space?

Assuming talent (e.g. market knowledge, quantitative skills, ML competence) was not an issue - how realistic would it be to get access to the fiber & real estate necessary to compete with the very few market leaders?
Check out Last Ape Standing by Chip Walter for more speculation on why homo sapiens were more successful than other hominids,

http://www.amazon.com/Last-Ape-Standing-Seven-Million-Year-S...
Did you even read the book? The entire point is that some HFTs are given priority fills on orders that no one else has access to, even when the HFT quotes are worse, in return for kickbacks to the exchanges.
I wonder if the trick is to just send so many things that memory wraps around to a place where the key is exposed.
A lot of 'real' (cough) hackers like to look down at MS, but Raymond Chen is one of those guys I'd hate to get into a technical argument with: he has experience, is extremely sharp, and very sarcastic. Those three attributes make Old New Thing my favorite MS blog even if I don't write Win32 anymore.

If anything, Windows' level of backward compatibility is a giant cautionary tale: enable poor behavior from devs, and it will proliferate. You cannot trust app devs to do the right thing, they need to be forced to; whether by gatekeepers at app stores, or OS restrictions. It is a tragedy of the commons. Whether it's inane programs inserting themselves into the systray, 'preloaders' for bloated apps (which slow startup), browser extensions, Explorer add-ons, or other garbage, app devs still seem to do a fantastic job of gunking up a Windows install.

This is why it's a bit of a blessing that webapps can't do much; because the more powerful they become, the more annoying and inane they will be.
>Not using OpenSSL doesn't imply that they are secure

Uhh, it does mean that they are secure from the HeartBleed bug. I think you're confused, OpenSSL is a piece of software, SSL is a protocol with multiple implementations. So it's possible to use SSL without using OpenSSL, hence the title of this post is completely wrong.
From L3 to seL4: What Have We Learnt in 20 Years of L4 Microkernels? [pdf]
I probably hit the server only a thousand times thinking that could be enough, I was far off.
A value of $0 to the employment probably makes sense, but it is a little more complicated, as:

I'm not sure that they'd buy my website without hiring me (that's the impression I've received). They said it would be more difficult, but they would consider hiring me without buying my site if it came to that.

I was trying to place what they'd be willing to offer, and I gave them a ballpark figure of "> 100k", which in hindsight was a bad idea. I'm a little worried that they are going to offer me exactly that now...

Note: Hacker News seems to be rate limiting my replies now, so I'm going to put some of my other replies here too.
I spent a couple of hours with their docs and built the following demo, which appears to work in all major browsers except Firefox. You could drag the background to change the angle of the iframe. Also, you could target a different webpage by updating the url -- be sure the webpage allows embedding as it's going into an iframe.

http://beta.mindcast.com/famous/?url=http://famo.us
That's the thought that's on the back of my mind throughout all of this. I do think talking to a lawyer could be a good idea, but I'm not sure how to go about doing this. My Uncle runs a small business, so I'll see if he has any suggestions - is there anywhere I can look for a lawyer? I'd be willing to spend some money to make sure I'm doing this right, I'm just not sure where to look.
Lewis may be a solid guy -- I don't know him, so I can't say.

I can say with a great deal of certainty that he hasn't read, or doesn't understand, any of the contemporary literature on market quality. If he did, he'd know that the efficient realization of market impact (you buy and the price goes up) is a property of effective markets. In the absence of actors to ensure this process of price discovery, all traders will pay unfair prices as small changes in supply and demand remain undigested.

I would also suggest that "young people at the best schools want to go skimming in the market" is reductio ad absurdum at best and ad hominem at worst, which sours my opinion of his ability to make a cogent argument without resorting to the Wall-Street-bogeyman trope. Then again, I suppose that's his job as a writer -- a story about the meek Canadian David battling the establishment equities market Goliath makes for a better read than a nuanced look at the role of various players in a complex ecosystem.

(Throwaway because my views are not necessarily those of my employer.)
Nothing in the article suggests we interbred with them.