skysight-inc/HackerNews huggingface dataset:
Yes I would think you should learn mobile development but you don't have to take off school, If you know the basic programming you should learn iOS or Android in few months after school and weekends. Consider College courses first maybe at Coursera.org they have few Android Courses, I learned Android in a month with also going to school but I knew Java. If you want to learn iOS Development, start with Objective-C I think in Itunes there are Stanford Courses about iOS Development, that should do it. If you want a career in Web / Mobile Development you should learn a lot of platforms, Because it is an incredible fast growing sector, I am sorry but it is I cannot catch it too. Before you jump off to mobile development, my advice learn the mobile website basics HTML5, javascript apps etc. Then the mobile development is another platform and you have to be really ready for it. Last of all, you don't have to break off school at any circumstances at all. Keep it going...
Yeah, your attempts to use sarcasm to show your point are not any good.
Agreed. Erlang's maps have two different operators when setting values on them, one if you care that the key already existed and one if you don't, so in that way you can still somewhat enforce strictness of keys. But you can relax that strictness when it comes time to roll out changes.
There must be a 'LAUGH' sign - because they are on cue even when the joke isn't remotely funny.
You're missing the point completely, still.

Computer security is like a genepool, and you can breed the strongest most brilliant thing you want in it, but when you cut down on diversity and then encounter some new virus that wipes everyone out, what happens?

Diversity alone does not solve the situation, you need a diversity of competent products, but having one loudly supported implementation that isn't nearly as good as people are led to believe is epicly stupid.

The fact so many people know that OpenSSL is a disaster area is even more damning for the security industry. Yes, Google are paying people to fix it at the edges, but it's clear from the likes of TdR that their whole process is broken, and yet in all the time it's been visibly broken to many of your insiders very little has been done to attempt to fix the structural problems, and a lot of effort has been made to shout loudly about how difficult fixing them would be, putting off anyone that might be trying to help. It's nonsense.

This is time for a bit of humility from the security industry, not for strutting around proudly.
How long would it take their staff to revoke a single certificate?

$25 seems expensive for something that can't take more than 5 minutes per certificate, unless there is more to it than I'm aware of.

I guess it doesn't really matter to them if they lose several free customers. https://twitter.com/startssl/status/453631038883758080

They're probably making a ton of money from this, in the long run I'm not sure it'll be worth it though.
Hey, if they're robbing you blind they probably do value you...
http://ycombinator.com/nums.html (out of date, they're even more skewed now)
Can someone shed some light on the reason why we're still bothering with "line is too long" in 2014?

I mean I'm not talking 300 characters-long lines here that's ridiculous, but the idea that a line with 90 characters is "too long" because some arbitrary limit in the width of certain terminal emulators back in the days was fixed at whatever number of columns seems really backwards.

So yeah, I'm open too any sane explanation of the why that is actually good practice beyond what I perceive as severe cargo culting.
Wow... so... it looks like I won't be doing business with Dropbox.

... I imagine they want an "in" with defense/govt contracts and who better than someone who knows how to get government money spent.

Regardless, if you feel or have felt your data was safe from prying eyes on dropbox-- after this I'd go somewhere else before that no longer holds true...

I imagine a conversation like, "oh yeah, we'll use Dropbox, we've got $150 million no bid contract ready... but we're going to need something hooked up at your data center. For reasons of national security we cannot tell you what it is or what it's doing..."

... though I suppose in general, if you thought data was safe in the cloud you're already lost.
We tried to move to Google Drive but are about to go all in for Dropbox for Business. The Google Drive desktop sync client (for Mac at least) is just not reliable enough. Make sure you trial Google Drive first.
Thanks for the thoughtful response.

Regarding your comment that "It will be interesting to see if a profit-based variation of Zidisha emerges...": it seems to me that you have a positioning dilemma. The minute you invite someone to lend for interest, you are profit-based. The fact that you cap interest rates, perhaps requiring that lenders charge far less than risk would otherwise indicate, doesn't change this.

If your lenders aren't motivated at all by profit, don't care to allocate capital in a manner closely aligned to risk, and you don't see yourself as being profit-based, why not simply allow me to donate money to specific individuals? Being able to target small donations to a specific person for a specific has a lot of appeal. In fact, there are certain charities I'm familiar with that I know frequently get requests from donors who want to be able to trace their donations. Unfortunately, tracking individual donations to individual recipients is something that a lot of major charities cannot do efficiently at their scale. It would simply cost too much.

Obviously, the lending aspect of your platform allows me to redeploy my capital, something I wouldn't be able to do if I was simply making a donation, but as with any other P2P lending platform, my interest earned is taxable income so contributing through Zidisha is far less tax-efficient than donating to a 501(c)3.

Here's an idea which may or may not be feasible legally/logistically: I donate $50 to Zidisha, which Zidisha loans to a borrower of my choosing. When that person pays back the loan to Zidisha, Zidisha allows me to direct the lending of $50 plus the interest Zidisha earned to another borrower. And so on.
This way's easier to read:

['FizzBuzz' if 0 == n % 15 else 'Fizz' if 0 == n % 3
else 'Buzz' if 0 == n % 5 else str(n) for n in range(1,101)]
The comments on the CNN Money page almost universally negative, and almost all based on misunderstandings or sheer ignorance. I wonder how much longer the tech industry can ignore the inevitable backlash from growing inequality in this country.
I don't think the gay community will earn much acceptance if they attack heterosexuals on questionable grounds, I just feel sorry for those who had nothing to do with this.
The problem isn't any one cryptography scheme; the problem is trust. How do we build a trust framework that facilitates commerce on a wide scale while remaining truly secure? I don't think we can; so we give up a little bit of security for a whole lot of economic benefit.

Without centralized, trusted gateways, it's not even clear that your communications are secure. They need to be centralized to make them easy to monitor and audit. With a distributed trust model, the compromise of one node can be catastrophic; all you're really doing is handing control of the trust network over to botnets.

This is a really hard problem. I can't think of a better solution that would serve the same niche as our current one.
It is still $125/user/year if you pay annually. It is $15/user/month if you pay monthly.
What you want is Moxie Marlinspike and Trevor Perrin's TACK.

It is already the case today that for Chrome and Firefox users, a compromised CA can't easily hijack connections to Google Mail. Not only that, but any attempt to hijack Google Mail connections in the large will run aground on Chrome and Firefox users, who will not only not accept the rogue certificates, but will also alert Google, which will put a gun to the head of the CA.

The feature that enables this is called certificate pinning. It works well for small numbers of high-profile sites, but requires manual intervention on the part of browser vendors.

TACK pushes certificate pinning out to site operators. It works like HSTS: the first connection to a website is trusted, and that connection loads up state that the browser holds. Subsequent connections check for consistency with the first connection. Dynamic pins, or "tacks", make dragnet surveillance of all sites asymptotically as risky as spoofing Google Mail. The attacker is nearly certain to accidentally catch someone with a tack loaded, and at that point the game is up: the attempt to present an otherwise-valid certificate that violates a tack is a smoking gun, to which Google and Mozilla ca respond with their own firepower.

The nice thing about TACK is that it works alongside the CA hierarchy, and even derives some value from it. A tiny fraction of the Internet could adopt TACK and still make life much harder for attackers. The effort required from site operators is small, and the whole system is invisible to end-users.

Fixing the CA hierarchy is a lot less sexy than ground-up rewrites of the whole Internet security model. But the ground-up rewrite is never going to happen, and the incremental fixes are not only doable, but doable by the kinds of generalist developers who are champing at the bit to stick it to the NSA. The biggest security problem on the Internet isn't protocols; it's browser UX.
And "changing the world" sounds great/positive, but it is often relatively neutral and sometimes negative.
Of course, they are disclosing their vulneratiblities, they disclose everything, and they have an established audit process. Quite the leaders in security in the free software world:

http://www.openbsd.org/security.html
Sigh, nice try but it doesn't work. It does remind me of the adage that goes, "For every complex problem there is an answer that is simple and wrong."

The web of trust model doesn't scale, that was made abundantly clear by PGP when it first came out. Even Phil Zimmerman, the guy that practically invented it, agreed it didn't scale and something else was needed. X.509 came about not because some person foisted it on the universe, rather a bunch of people who were writing security systems at the time (myself included) got together with other cryptographers, engineers, and administrators under a group hosted by "Public Key Partners" (the folks collecting together the Patent pool associated with public keys) and tried to come up with ways this might work.

It has had some fabulous successes, certificate authority compromised? Pull their root cert and blam none of their keys are trusted any more. It had some failures. Call the baby ugly if you must, but at least propose something that hasn't already been tried and shown not to solve the problem.

[Edit: I really need to keep peoples names in different buckets in my head]
Only if they were impacted by the bug.

It's rather unreasonable to expect sites that know they were not impacted will update their certificate. So unless you want to write off your bank's website for the next year or three until the date expires & they renew it then, (banks seem to have avoided this- suddenly dawdling behind the bleeding edge doesn't look so bad!) scorched-earth policies are a bit much.

Actually I might even say the opposite; if the site is secure and the certificate is older than 4/7/2014, that suggests the site was not impacted. If the certificate is newer than 4/7/2014, that pretty much guarantees the site was impacted. It is possible the site patched openssl and did not renew the cert, but in general people are not going to do one without the other.
WoT won't work, yes.

> Sure, the PKI isn't too great, but its what we have, and it is currently more practical than any other solution out there. Security needs to be usable to be useful.

But I disagree with you here, there are better solutions that are just as easy to use:

- Some options: namecoin. If you own the domain you can easily sign stuff with the same key you use to own the domain

- Put stuff in DNS's TXT record once DNSSEC is rolled out. (Or create a new record)

Or take a look at TOR hidden services for example.
You enter a onion domain. And you're there. Guaranteed. No messing around checking if there is a green lock or messing around with a WoT.

Note namecoin might not be there yet to be usable for 08/15 users. And most of them probably don't want the blockchain locally. But it's easy to imagine that you just have your ISP still provide you some sort of DNS service.
Nice scroll animation.
Yes, and "sit there refreshing a page over and over waiting to see if they update it because they refuse to even give you a hint of when they expect to be done" is not acceptable.
FYI, you should take a look at DNSChain:

https://github.com/okTurtles/dnschain
Would love to reach out, shoot me an email.
The other hard part about it is that Haskell's FFI doesn't support variadic functions in a friendly way, which makes argument passing that much trickier.
There are no testable assertions in your comment, nor any specific facts. I took the time to respond to your comment with citations to previous vulnerabilities and assertions about the impact of "monocultures" on them.

It's a little uncharitable of me to say this, but: I anticipate you won't actually respond to those assertions. So I guess I'd then ask: who has the more trustworthy argument? The person appealing to emotion and sinister (and, in this specific case, silly) motives, or the person who can refute an argument with specific examples?

If you think OpenSSL is "damning" of the whole "security industry" (whatever that is), you are of course welcome to start your own "security industry". If you can find the kinds of things "priests" like Neel Mehta can, I assure you, you'll be richly rewarded.
[competition]: Win 1 of 2 copies of iOS 7 Programming Cookbook
This also breaks GitHub Pages. I can very mine is down.
I'm firmly in the "So what?" camp on this.

IRC servers have been known to do this as well, from time to time, as bot mitigation.
Ruby on Rails 'arbitary code execution'? Debian removing entropy from SSL?
StartSSL is actually causing a problem, though.

With a regular CA, you pay upfront, and you can revoke and reissue with no problems. If you trust a CA that does this, you can count on the fact that anybody buying a cert from that CA has the ability to grab a brand new certificate whenever they want until the expiration period.

But with a CA like StartSSL, they give out certificates without guaranteeing that websites using those certificates have the ability to regenerate their certificate. If a website gets compromised, since they haven't paid upfront, you don't know if they will pay to reissue. They might just keep quiet and pretend there was no security breach, instead of doing the proper thing and renewing the certificate. If you know they paid upfront, you can be more sure that they will take advantage of the free renew upon a security breach.

I find this issue to be vaguely similar to the difference between socialist healthcare systems and privatized healthcare systems. If everyone is guaranteed to have healthcare because it must be paid through their taxes, then people are generally healthier since they are encouraged to go to the doctor. But if you must pay a bill whenever you receive healthcare, people might be encouraged to forego treatment or checkups that could catch deadly diseases in an early phase before they become life-threatening. I don't really think this is a good analogy though because the other pros and cons of both healthcare systems don't map well to this problem.
The reason failure is OK is because there are a variety of factors outside of your control, and your ability to succeed may or may not depend on that variable. Whether it did, you'll most likely never know.

The possibility of failure based extraneous conditions already makes failure OK.

My internet marketing business failed because Google changed their SEO guidelines and it shut me down. I did everything perfectly, or so I thought, and then it just happened. That's alright.

I think failure should be taken in context. Recently in a big project at a bank (absolute disaster of a project, most of us quit), I am seen as a failure because I do not spend my time after hours (unpaid) working, while the rest of my team does. Is this in my control? Yeah sure it is, but at the same time it isn't.

> On the flip side, if you failed - that failure acts as a noose going forward.

A personal fail is a form of personal victory, seen as failure by everyone else who isn't you.
A lot of developers use vim, with split buffers. When code lines wrap, they look ugly.
Can Design Save Silicon Valley?
Google wasn't a big company when Jeff & Sanjay started there.
Explain how the existence of Microsoft SChannel and HSMs corroborates your argument instead of refuting it?
Jony Ive shakes up Apple’s software design group
>Should we assume any competent government like China (through it's Great Firewall) has gained access to a large pool of secret keys used on the internet? The potential that they have known about the exploit for 2 years it is without doubt that they could have captured any secret key they wanted.

There are so many things wrong with these two sentences I can't decide where to start.

Maybe a good launching point is the fact that it's never outlined why China or literally anybody else has any "secret keys". In the next sentence there's a reference to "the exploit," but obviously we could be talking about any exploit. Are we talking about any exploit? Who decides what exploit we're discussing? Do I get to pick my favorite?

>competent government like China

Why a government? Why not anybody else?

>(through it's Great Firewall)

In English, this bit expands to "(through it is Great Firewall)" or possibly "(through it has Great Firewall)", which are not real sentence fragments that mean anything. If we assume, for the sake of brevity, that our author meant to use "its" instead, the sentence is now grammatically stable but still doesn't mean anything to the reader. Why is the "Great Firewall" relevant?
I know there are several desktop apps built using Mono for Linux but I suppose people have their opinions with respect to Mono.

My biggest grip with Mono is the lack of automation tools (SCM in this case) and that alone is a show stopper for me. Maven and Eclipse/IntelliJ spoiled me too much that I'd rather not touch Make/Ant/CMake/MSBuild. MSBuild is Microsoft only (despite there may have been some support in Mono, as you have read the article, it's still Microsoft exclusive tool).

I'd love to use Mono to develop cross-platform desktop application. I really really really do. In fact, I decided to give it a try one time despite its shortcoming that I mentioned above. In the end, I felt that there's simply too much work for me to build any side project using Mono.

This may not be the case for serious commercial desktop app because they can invest more resources to deal with the automation tools. But for side project? Mono would definitely not on top of my list.
Do you know responsive design?

Also there is a growing trend of people, or should I say major companies, using frameworks that can take html5 and javascript and deploy them as mobile apps such as PhoneGap and Ludei. After all that is the goal of html5.

I think Paper53 was built on one of these platforms.
My point is that there have probably been hundreds of these types of events going back to the ancient times of the internet. The sky is not falling guys, just a good downpour.
2009 called - they want their pricing model back.

It's amazing that the industry has come so far that it now seems normal to be able to spin up a server, have it available in a minute or so, then bring it down when done with it and only pay by the minute or hour.
There's no honest attempt to explain the philosophy behind every language with real-world examples in Python. It's just childish jokes.

It's the equivalent of saying "Ze fish in le river" is "Frenchish English". Ha ha, stupid French people, right?

It's easy to make fun of programming languages like this, but what does that teach us? Aside from to mock what is different than what we use right now?
It goes farther back than terminal emulators. the old IBM punchcards physically only had room for 80 characters.

I'm with you, though. 80 characters is really short, especially if you are indented more than a few stops. It also discourages descriptive variable/method names, which harms readability of code far more than slightly longer lines.
Surely the US government is also a large threat to internet security? Not just China? :P
> enough to make the utility loss worth it for most people

The author of the essay (I believe you are the author) says "don't double major" and that a double major is "a very suboptimal strategy."

You now write that it's not worthwhile "for most people", which implies that it is the optimal strategy for some people.

These two statements are not in accordance. Which is it: a bad strategy for everyone, or good strategy for only a few?

That you think it is never worth the effort therefore more likely means that you have incomplete information about the utility of a double major, and not that the myriad of people with double majors have made the wrong decision. I actually think it's because you don't understand your own mental model.

Many fewer people double major than get a single major. In a utility maximization framework, this indicates that double majoring is sometimes worth the extra effort. In your statement here, you believe the additional utility is an order of magnitude less than getting a degree in the first place. In which case, if the additional effort is also an order of magnitude less (assuming linear scaling) then it's worthwhile.

Assuming 120-130 credit hours to graduates implies 12 hours for a second degree is an acceptable amount of additional work. You mentioned elsewhere people who were "three boring classes" away from a double major. That's 9 credit hours, which means it's likely a reasonable decision under the model you just proposed.

Your statements don't seem to be in agreement with your model. Can you explain how you used that model to come to a different conclusion?
Yes, there is a language pack for SICP especially!

http://www.neilvandyke.org/racket-sicp/
We re-signed our certificates after Heroku patched the issue.
Its pretty hard to have "genuine wrongful termination" without actual termination. Especially if the staffing agency quickly finds you other work, even if the other company motivation was "wrongful", you're going to have a hard time establishing compensable harms stemming from it.

If the staffing agency knew of the wrongful reason, and because of it (or because of the other company's decision to end your assignment with knowledge of it) they then declined to assign you other work, you might have a case for wrongful termination case against them (by way of constructive dismissal), but there would seem to be a number of things you'd have to prove there that you wouldn't in a direct employment wrongful termination case.
Let's surmise that the reason two distinct researchers (Mehta and Codenomicon) found this same bug in a short timeframe is that the recent Apple & GnuTLS bugs have caused many teams to begin a fresh review of long-ignored shared codebases.

If so, is this the first major bug discovered, with many more to come as they are flushed out by the new level of vigilance? Or, is it the only/last one, being revealed now because the deep dive has now wrapped up?

Those seem to me to be the interesting questions.
The Forrst is Growing Into Something New