skysight-inc/HackerNews huggingface dataset:
This is absolutely fascinating. I didn't realize that today's nanofab labs used technology that was available in the 1950's (e-beam lithography is pretty common, with a second contender for nano-scale structures being FIB[1] milling).

The article's amazing for being a look into a future that could've been. A number of physics tools that are around now depend on microscale cryogenics, but they're still fairly rare (like SQUIDs[2]).

[1] http://en.wikipedia.org/wiki/Focused_ion_beam
[2] http://en.wikipedia.org/wiki/SQUID
I find it a stretch to believe that some part of the NSA didn't know about, and/or have a hand in introducing, Heartbleed. There has to be an NSA team dedicated to both causing and exploiting issues with very popular open source software. If there isn't, the NSA isn't living up to its reputation.

The reality is that we'll never get the truth out of them, and it doesn't matter anyway because nothing they say can be believed. They might as well never say anything. Assume that they have intercepted all of your traffic and have dumps of your RAM, and act accordingly.
So this does mean that I need to change my passwords on every damn site on the list? Oh bollocks, those passwords were a work of art.
How to fix a bleeding heart
Nice, glad to hear and thanks for the feedback. I agree clearly communicating the value of your unique skill set is key. Any other ideas please keep them coming
Climbing down the tree: framework and performance
If I had unlimited funds, I would go to Finland and take their top of the line driver education course for a summer's vacation.
Google Bus Protest Organizer: "We'll Take It to Their Homes"
With regard to the Linux kernel, for example, their policy was to not look for vulnerabilities and only contribute features:

Did you try to fix any vulnerabilities?

No, we did not look for or find any vulnerabilities in the course of our work. We only changed enough to add our new mechanisms.

http://www.nsa.gov/research/selinux/faqs.shtml#I16
Take a look at github.com/drone/drone for an upcoming CI platform built around Docker. It's totally open source, but you can use the hosted version at drone.io as well.
Cool stuff, Austen. Good to see a product that cuts through the noise online. What do you think of inside.com from Jason Calacanis?
> ...but so to is killing someone because it's fun to drive fast...

How often do you think this happens?

The NHTSA has a talking points primer for prosecutors with a few numbers on unsafe driving. The numbers are outdated, but they give us something to work with: 13,000 people were injured or killed between 1990 and 1997 because of aggressive driving -- a broad category that includes not just speeding, but also tailgating, lane changing, and improper passing.

That's 2,000 people per year for that period, and since that period, the number of vehicular fatalities has fallen off of a cliff: "The 32,367 traffic fatalities in 2011 were the lowest in 62 years" (http://en.wikipedia.org/wiki/List_of_motor_vehicle_deaths_in...).

Every single time I have looked, I have been unable to find any evidence whatsoever that doing 85mph on the freeway in safe conditions significantly increases the chances of injuring yourself or others vs. doing 70 in the same conditions.

Yet speeding is this one traffic behavior that people really seem to get riled up about.

I have a suspicion that the actual reasons for this are that speeders tend to be unrepentant, and that it's a flagrant breaking of the law -- it's visible and people notice it more than possibly any other driving habit. Those things together seem to trigger some people's moral crusader button.

I won't quite go so far as to defend speeding. I'm never the fastest driver on the road (anymore). But if someone really wants to get going about the dangers of speeding, I'll be happy to point out all of the other driving behaviors that are at least as dangerous -- probably at least one or two of which the person themselves is guilty of, as we all are.
I wonder if this is such a good idea, since we all know that everything on the internet is true.

It takes some real skill to find reliable, accurate, up-to-date information on the internet. Could NTIS still serve a purpose by Googling for more critical research? Or maybe the idea is that that job is for the Congressional Research Service.
On the other hand, if anyone asks me to justify all that "unproductive time" this week, I don't need to handwave and explanations any more.
Social marketing is over-rated... no real winners there...
Core node.js dev, based in Moscow, commits open source almost daily, works at Voxer, cracks security for fun.

I love the internet.
No. This means you need to change keys for every ssl service you run. Passwords were known to be leaked earlier.
who is us?
Love this idea. My only crit so far is that you limit my password to 20 chars. Really keen to see where you go with this :)
Thought you'd say that. :) Oh my grandfather carried a concealed pistol or plural everywhere that was legal.
So, I for one am convinced at this point -- largely by your comments, but also the rest of the thread -- that this proposal would burn too much goodwill. I think charging businesses for "something" is an avenue that needs to be explored, but early notification is clearly not that thing.
"various services that are not associated with NTIS's primary mission"

My interpretation is that they are simply providing other services and charging for those to make up lost revenue.
Interesting that they used computers to make them. It seems obvious in hindsight; player piano music is digital!
Japanese railway operator to license maglev tech to US for free
Raking in the dough on Free and Open Source Software
New PRIVATE KEY, then new certs with that key.
Many parts of government run Linux, including NSA themselves, other military platforms, and advanced research/development labs. Certainly there's tons of MS, but govvy is just so big that even OpenSSL being rare would still be highly concerning for USG security.
A reasonable policy upon discovering this type of bug is to allow the agency a fix period of time to exploit the bug and then require that they provide support in fixing the bugs for as many major US companies and institutions as possible as quickly as possible.

If they are given carte blanche to use the exploit indefinitely, they will keep it forever and let the world discover and exploit it as well. If they have a finite time period like 1-3 months, they will prioritize exploiting those systems that are actually valuable for national security. While they are doing so, they should keep an auditable log of all the systems they use the exploit against so that oversight may be performed in hindsight. Furthermore, they should absolutely be barred from using any exploit against a target with a US-based IP, or possibly even any IP address in allied nations.

It is far less likely that the agency will have the opportunity to abuse exploits if they are forced to prioritize targets due to a fixed deadline on disclosure.

During the deadline period, they should also be working on a plan that minimizes the amount of damages once disclosure is forced. i.e. there should be a list of people and companies that get the information first and everyone on the list should be people in charge of protecting computer systems (i.e. no one involved in offensive activities is on the list). Companies like Google, Facebook, Akamai, Apple and the package maintainers for all the major *nix distros should be on that shortlist of those that get priority notification.
I honestly would recommend some insightful reading over some PG's essays, they are priceless (http://www.paulgraham.com/articles.html). Here are some that are related to your case and might be helpful:

http://www.paulgraham.com/love.html

http://www.paulgraham.com/investors.html

http://www.paulgraham.com/equity.html

http://www.paulgraham.com/disagree.html
I was lucky, my boss understood pretty quickly how big a deal it was. My project manager didn't, though, but he did pretty quick when I cracked our dev server and told him his password for a couple of services.

It was fun playing pen tester and getting paid for it this week :)
We have reached out via twitter to this invidiual as to coordinate the delivery of the $10,000 bounty we offered. If anyone is already in contact with them please direct them to https://news.ycombinator.com/item?id=7572530
How about:

1) Simple redesign of home page,

2) Showing prominent sponsors who've paid more than some amount in the last 12 months (e.g. Google, Redhat, Akamai),

3) And leading contributors

4) And news other than vulnerabilities (e.g. code fixes, new tests, etc.)

It might not net $800,000 per year, but it would probably help.
The press is all over this topic, but as usual doesn't do its research well enough. Some insight: the bug was submitted in December 2011 and was only present in OpenSSL 1.0.1 - not in previous releases. 1.0.1 was released on 14th of March 2012. It usually takes a long time until this new versions get largely adopted into other software. Even today 1.0.1 isn't used everywhere. That leads me to doubt that the agencies could have used this vulnerability for a very long time. A year seams reasonable, years rather not. It's very sad thou, that they choose not to contribute to secure software and rather exploit the vulnerability.
Homo Sapien. The article uses Human to refer to the Homo genus (Homo Erectus, etc).
This is actually a rather good cheat-sheet. I'm usually a fan of using cheat sheets, lists of commands, etc. to pick up new languages, but I have my reservations specifically with regard to a cheat sheet for Haskell.

The trouble with the cheat-sheet approach to Haskell stems from the fact that Haskell is quite unlike most other commonly used programming languages, i.e. substantially unlike the languages that someone reading the cheat sheet is likely to know. As a rather strictly FP language with a very strong type system, it is unlike the more mainstream languages on both a deep, technical level and on a superficial level (e.g. syntactically, the 'look' of the code, etc.). This means that you could use a cheat-sheet to write some trivial programs, but it would be hard to progress further, because you would, on a very fundamental level, not know what you are doing.

The same goes for C. While a cheat-sheet can tell you all about the printf function, data structures, types, etc., it is unlikely that a cheat sheet will be sufficiently informative on memory management, using the heap and the stack, pointer arithmetic, etc. --- the really crucial things that one needs to know to write C effectively.

While a Python programmer could use a cheat sheet or learnxinyminutes.com to pick up and write some basic programs in Ruby, it's hard to do the same for languages like Haskell or C, which really require understanding beyond what a 'cheat sheet' communicates.
Windows is not a Microsoft Visual C/C++ Run-Time delivery channel
The Illinois Commerce Commission websites do not use OpenSSL
"The reality is that we'll never get the truth out of them, and it doesn't matter anyway because nothing they say can be believed."

This is clearly now true for many of us.

I wonder how true it's becoming for the people to whom the NSA provide their information? When Clapper happily uses phrases like "the least possible untruthful answer" when explaining to congress why he said "No" when the answer was "Yes", I can't help but wonder if the FBI/CIA/Pentagon/President/B-613 are starting to question/disbelieve every word that comes out of the NSA?
Either way Clapper would be breaking the law. In this case was placed between the choice of breaking his SF-182 NDA (which actually does have criminal implications... just ask Snowden) or lying to Congress in response to a question that the Congressman asking knew the answer to, but didn't want to take the risk of putting into the record himself.

An interesting take on the matter is at http://joelbrenner.com/clapper-and-wyden-scenes-from-a-sandb...
Ask HN: Should I publish Heartbleed statistics?
Hello HN, I've modified some public exploit code to scan a list of HTTPS hosts and calculate simple statistics. None of the data that the exploit retrieves is logged.
I've run it on one list of hosts with OpenSSL/1.0.1 in their Server header, and am in the process of scanning a larger, more statistically significant list of assorted HTTPS hosts. The OpenSSL hosts have a 42% vulnerability rate. :(
I made this with the intent of creating a "heartbleed monitor" website, but all of my friends tell me I'll go to jail if I publish these results. Do any of you have thoughts/advice?
Thanks,
Anonymous for now
The latest Kindle Fire works perfectly for me. I even installed the Google Play apps I wanted through an APK downloader and sideloading.
Woah. I'm in Ledbury for a few months as well. Really funny seeing other people from around here on HN!
OMG, I remember that year! It was even worse in 2003 when they moved it to Moscone. Fresh made Jamba Juice and mounds of Krispy Kreme donuts galore. It was super gross to be honest. :-) I haven't eaten a Krispy Kreme donut since that year.
In California VC Section 28150, a LIDAR jammer in of itself can result in a ticket. Best to coast and switch it off very quickly. In my experience only about 20% of patrol cars used LIDAR, the majority seem to be using K or Ka band RADAR. X band is so prone to false alarms and never had an actual alert on it that wasn't a speed sign so, disabling it is common.
> Effective on the date that is 1 year after the date of the enactment of this Act

So government documents are the inspiration for the way the Krang talk in the new TMNT cartoons...
You're right. Not taking your turn at an intersection can cause a fender bender, but that's still falls under annoyances rather than real danger.
The list of questions was pre-approved. When he made the decision to approve that question, he made the decision to perjure himself.

Edited to add: Or at least, the decision to break the law. Which law may have been decided later.
Love to see a post on how it was done and the tools he used.
Don't worry they'll change that when the senate and congressional bill are reconciled and the NIST will be disbanded while the NITS remains.
The -1 in SHA-1 isn't because it was first. It was meant to be just "SHA", but NSA discovered a flaw in their own standardized hash algorithm soon after they published it and issued SHA-1 as a fixed version.
https://twitter.com/indutny/status/454783660886360064

Just awesome. Only 3 hours to rip out the key!
Well, so much for wishful thinking.
How I understood it, and please correct me if i am wrong, is that a machine than can caluclate numbers with infinite precision in constant time has certainly a time benefit, but not necessarily a broader class of computable functions compared to a Turing machine. I interpreted z3phyr’s reference to Wikipedia as a hint to that idea. But I agree that the most convincing arguments are against the existence of such a machine.

(By the way, writing "No.\n\n" can be received as a rude response. I felt a little bit uncomfortable reading it.)
Currently many amazon user are tied to the ecosystem with one of the below components. Amazon phone means they will end up being tied to a lot more (if not all)-

Amazon App Store - Apps;
Amazon music - music;
Amazon video - video;
Cloud Drive - to backup photos and files;
Amazon app/Flow app/amazon fresh - shopping/grocery;
Kindle app - books;
Amazon games(gamecircle) - gaming;

I think the only missing component is 'messaging'. They don't have anything equivalent to google hangout or bbm or WhatsApp.
The questions were pre-approved. He could have objected to it beforehand, in private.
I've never even thought of that. Wow. Obvious now of course.
Fair point, though I'd argue that this is an independent issue from on vs. off the clock.
Furthermore, if a piece of software is responsible for protecting a huge percentage of the internet and is known to be a mess, you can be absolutely certain that there is not just one or two researchers, but possibly several teams responsible for probing that code base each and every day looking for exploits.

I would be surprised if every single commit to OpenSSL doesn't get dozens to hundreds of man-hours of attention from people very good at breaking secure systems.

With that in mind, you can also be sure that the NSA isn't the only government agency that is putting tons of money into exploiting OpenSSL and other critical software. I'd be surprised if it took them more than 1-3 months to find this exploit after it was introduced. If they found it in that time, you would expect that other government agencies found it nearly as quickly and have been exploiting it as well.

When you have million and billion dollar budgets used to find and exploit bugs in software, you can be certain that the average person is losing out big time.
Really it means (as everyone assumed in the first place) that anything a web server might have in its heap needs to be totally thrown away. Private keys. Passwords. Credit card numbers. Security questions/answers. Sessions.

Anything you'd send to a web server or receive from a web server is presumed compromised.
People complain all the time.
Likewise. I'm still not 99% sure...
There's quite a large effort in superconducting qubits, superconducting quantum limited amplifiers, at least one company doing rapid single flux quantum circuitry. Superconducting circuits are reasonably popular.
Worked for me running Firefox 28.0 on Linux, no security warnings. Yikes!
Depends on whether things like this are a security disclosure or not (seems not to me, but I'm not a vuln developer): http://lists.x.org/archives/xorg-devel/2010-August/012207.ht...

I don't know of better examples though.
I'll admit, it threw me off at first too.
But it's so much more gratifying when we have them.
Good idea. That's long been a search that I felt would open a Pandora's box I might never again climb out of. :-)

I found the Instructables which has a lot of excellent craftsmen and asked in their forum. Fingers crossed.

FWIW I really would like to know why my question was voted down to help me understand the ethic (esthetic) here?
Hell, even Julian Assange has spoken up in support of targeted spying efforts.
Can someone elaborate on what's going on here?

If i replace his IP with some other random IP I get a 400 bad request error, so it's obvious that it works, but curious how that resolves.
Twitter debate on Google paying teachers up to $2500 to teach girls to code
For people that think that "C is not the problem":

http://queue.acm.org/detail.cfm?id=2010365

This is C thing, that have a lot of problems. In pascal, no problem.

And the worst?

IS STILL A PROBLEM. Decades after.

And this is only one thing.

The other bug:
http://www.slate.com/articles/technology/bitwise/2014/02/app...

Is a C problem. No just the goto. YEARS AFTER, still here. IS the "brace" thing. Is not mandatory.

C have a lot of stupidity built-in (ie: Bad by default):

http://www.drpaulcarter.com/cs/common-c-errors.php
http://www.andromeda.com/people/ddyer/topten.html

Some of this are not corner cases, and could be say are unnecessary to fight them decades after. You know, if B turn to C, why not turn to something better? Instead, the inertia (like happend with javascript) is push and push doing things the hard/dumb way because, well, all that people that have worked better from DECADES, they are wrong.
Correct! The 55mph law was first started during the gas crisis of the 70s. Its impact on traffic safety has been argued back and forth ever since, but so far there is zero concrete evidence that the increase in speed limits has caused a likewise increase in fatalities. (I have heard some good-sounding arguments that 55mph on long stretches of road is actually more dangerous than 70mph on the same, but I cannot find any studies to back that up, either.)
I should have mentioned that I'm 70 and my hands have long been too unsteady to attempt this myself (if in fact they ever were.)
Practically treasonous. As they say, lots of important things protected by OpenSSL, and if the NSA did know about it two years ago, when did similar organizations in other governments spot it?
So she signed off on torture? Or is being a "prominent" member of anything now a crime?
I applaud Lewis' effort and maybe it will sink in this time, but this is not really news for a lot of people.

The story is that Wall Street big powerful trading firms have an inside edge against retail (middle class) customers.

It's not exactly new. This has been happening for decades.

They did it before computers with information, now they are doing it with fiber cable.
New profiles are coming soon.
Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name.

Then, your browser checks the received certificate against the authenticated TLS connection, and sees that all is well, allowing you to connect without a warning.

Since the browser does not warn of a certificate mismatch, he must have a valid certificate for 'cloudflarechallenge.com'. QED.
Perhaps, once a service has addressed the heart bleed vulnerability on their servers, deleting all passwords and forcing users to go through the forgotten password process might be the responsible thing to do.
Some Airbnb Hosts In San Francisco Are At Risk Of Eviction
I have pretty bad ADD, but I guess I'm lucky that my medication helps a lot.

I'll try to set aside some time to watch this video and take some notes. It may take a while but I'll ping you if I manage not to get distracted in the process :)
AWS has Amazon Linux: https://aws.amazon.com/amazon-linux-ami/

Since its the default OS for Linux on AWS, it probably has a pretty large install base. More than most would probably assume.
Federal agencies routinely charge other federal agencies for services. Just because it's "all taxpayer money" doesn't mean that each agency doesn't have to fit within their own budget.
Maybe for base salary, but Amazon is mostly stock (or bonus if you are new) heavy in comp...
A possible smoking gun in this case would be to check if most of the NSA's and the DOD systems over which it has oversight were not vulnerable this entire time while the private sector remained vulnerable.

If they truly didn't know about this, you'd expect that a lot of the US government infrastructure has also been vulnerable this entire time.

I've seen the Alexa top 1000 list showing who was vulnerable. I wonder if there is a similar list for the top 1000 computer systems and networks over which the NSA has security oversight.
One of the first things I noticed as I skimmed over some of the tweets was that if the discussion had been started with a blog post that detailed all the arguments at the start, some of the back and forth elaboration of points (as well as the bickering and insults) could possibly have been avoided. But of course, that's just me looking at it in hindsight. To Zed, maybe it was just something that he saw and quickly tweeted about, without giving a second thought about what could ensue afterwards.

Also, I think this is on point[1].

[1]: https://twitter.com/_s_e_r_g_e_/status/454783233377312770
Remote detectors have the double advantages of stealth and better positioning of components.

Bel Pro RX75 Plus off the internet for a few hundred bucks and installing it was as easy as running a few wires.

Radar under the fiberglass hood at the very front of the vehicle, it's away from everything ferrous, LIDAR receivers|emitters in both front fascia vents and on the rear license plate frame further concealed by a generic-looking custom frame.

The display cannot be seen from any angle unless you slouch like a gangster in the driver seat. There's absolutely no trace, no cheezy over-stretched coil from the visor down that can be seen from Nevada.

Might upgrade to BEL STi-R Plus.
Idea of New Attention Disorder Spurs Research, and Debate
This was better:

http://en.wikipedia.org/wiki/NERVA

If we hadn't canceled it we'd be colonizing the Solar System by now.