skysight-inc/HackerNews huggingface dataset:
Native-sounding translation:

The cases of adding CloudFlare CDN-service internet addresses to the unified registry of prohibited information have become more frequent. This is related to the active use of the above service by sites which violate Russian law. During attempts to ascertain the hosting provider of these websites, whois reveals ip addresses belonging to CloudFlare, hiding information about the whereabouts of the hosting provider of the actual site.

This makes cooperation of the ROSKOMNADZOR[1] with the actual hosting provider difficult and basically eliminates the possibility of removing illegal information in order to restore access to blocked resources.

CloudFlare representatives refuse to cooperate and do not respond to official notifications by ROSKOMNADZOR.

As a result of CloudFlare's lack of response, many conscientious internet resources using this CDN-service are falling under[2] blocking restrictions by ISPs on Russian Federation territory.

To avoid similar problems, we recommend hosting websites using the facilities of domestic hosting providers, which comply with Russian legislation in good faith and restrict access, in a timely manner, to internet resources containing information whose dissemination in the Russian Federation is banned.

[1] Federal Service for Supervision in the Sphere of Telecom, Information Technologies and Mass Communications (ROSKOMNADZOR)

[2] Unclear from the text whether this already happened or will happen
Similar could be said for Goto Fail and the GnuTLS bug. I wonder how something like Coq could handle the Debian random number bug, though. Still, 3 out of 4 ain't bad.

Do any functional or logic programming languages or libraries have a concept of entropy, and entropy generating/reducing operations?
I saw they added AES-NI support in PolarSSL 1.3.3 just before the start of this year..
Yes golly you must be right, i bet google just uses rsync to copy the passwords of billions of user accounts to thousands upon thousands of machines all over the world, in plain text! It's probably in /var/lib/every_user_password_in_plain_text.txt!
Working simultaneously vs waiting simultaneously
'Wearable Eyes' Make You Appear Friendly, Social Even When You're Not
You can trigger compliance effects with a can of soda. Of course there needs to be a correspondence in magnitude, but it's not really about the absolute amounts.
Thanks for the quick reply! I signed up for your newsletter, so I'll hopefully see it when there's another batch. Coming from Hamburg, Berlin is a much better fit than NY :)
I like your version better, but I suspect it would be significantly slower for many compilers that you are not testing.
I'm disgusted they chose to share it with you early and not the major Linux distros...
Exactly. I just saw that the local bank my parents use is still vulnerable to the Heartbleed Bug. But you know what? I don't want to go down there and talk to them because I'm quite certain they'll call the police because I "hacked into their systems".
/proc/self/exe
Same here, this is a great idea. An ideal setup, would be an agent, that could find me 15-20 hours/wk consistently, at my current rate (125$/hr), so that I can split time between the company, and the contract. I'd give away 25$/hr of that hourly.
Analyzing NBA skill gaps in python
Which they just released there fix for in 1.3.6..
(Floated by on Twitter a few minutes ago)
Avoid anywhere too close to Russia, it might not stay "in Europe". Instead it will "always have been part of Russia".
I hope you're doing this because you're passionate about it, because my understanding is that Hacker School doesn't make much profit.
What kind of monitoring would you deploy that would raise an alert for a process opening and reading readable files?
It's certainly interesting to read this sort of reflection. The author discusses Jobs' mannerisms without either worshiping or demonizing him, which is refreshing.
Nope but if you have root in production servers you can just peruse the RAM.

Nice throwaway. LOL.
My experience wasn't much different in the 90s, except that instead of D&D and rock music, it was Pokemon and Magic the Gathering
They have a standard FOSS License Exception allowing you to use it with all the regular Open Source licenses..

Link: https://polarssl.org/foss-license-exception
Show HN: A New Generation of Web Forms
Is it really much less? Last time I was let go I was given less than $5000 severance pay, and that was as a developer.
I think they couldn’t read /etc/shadow, so it’s not that bad at first. But then they could surely access some configuration file of the application itself, probably containing DB creds and of course more information which helps to find more vulns.
If you're also wondering about what the changes were for 4.0 https://github.com/visionmedia/express/blob/master/History.m...
n.b. the vast majority of Amazon warehouse workers are not actually employed by Amazon; it is unlikely that they ever get these offers.
Mini Metro
I grew up in the same town as Bob Jones University. So they were really frothing at the mouth over the game (I picked it up just after AD&D came out). They were into picketing at the time, and protested outside a couple of bookstores that sold the game (they also protested Monty Python's Life of Brian, which I am proud of having crossed their picket line into 94 minutes of sin & depravity).

It was pretty counter-culture for the time. Some of my friends would have been called "goth" in later years, but this was before all that.

In college I drove down to Jacksonville for GenCon South, and got eliminated from the tournament pretty quickly (our party wandered the desert, got lost and died - we never even found the temple. Bah.) But it was amazing how many other people were into the game, way more than just the 4-5 people who played that I knew.
The biggest offender for me, besides nuget being pretty much useless for real work, is that you need to install Visual Studio to automate headless ASP.NET builds! That's insane. Even the simplest most barebones ASP project requires it. As a result, our Chef scripts include downloading and installing a bunch of MSIs from S3. I would love to be proven wrong.
As much as the the $1bn exits are revered, 5 yars to $1m USD revenues IS quick success. Most who start a company will never get to that kind of revenue, and of the ones that do, many will take far longer. It's an impressive feat.
I have a question:

If there is an dead account which never had any sort activity, is there some legal/moral way to get its username? I would like to buy it, but owner does not respond. There is also no trademark violation, so I can not use official way Twitter handles this cases.
That's a valid technical reason why there isn't a std::sort that takes containers. It's not a valid reason why there can't be a std::range_sort or std::range::sort that takes container arguments.
I was introduced to D&D at my local library.

I spent a great deal of time in my youth studying the demons and devils sections of the Monster Manual.

Only years later did I learn that the devils were all sourced from actual religions (tiamat, beelzebub, etc). It helped spur my interest in ancient civilizations.

These days, I get calls from friends- all successful, happily married with family and kids- to play D&D.

The people who complained about this back then had NO IDEA how powerful games and myths can be to developing children- in a very positive way.
Huawei has 4G routers with Linux busybox and everything, and a "Written offer GPL" but, when requested, they dont give a shit about it really.

Ive had more products break GPL than Ive broken copyright before I learned Linux when I was pirating windows software.

Just not much to do really, its only the copyright holder that can actually push for enforcmenet of copyright, and me as a user am pretty much screwed.
To be fair, there are some that respond more graciously than others, but it's entirely unclear.
I think the rise of async/select based and privilege separated designs tend to suggest that threads don't work well for system programming.
Thanks. This makes a lot of sense, and matches what I saw myself. I never got anything out of nginx, but I found apache quite easy. I never built more than a POC, and left it at that.

I didn't think about it at the time, but it was only on a newly started apache instance.

Coupled with the fact the apache as a frontend tls server is pretty rare on big sites nowadays, I'm feeling pretty good about what did happen, vs what could have happened.
What do you do? Why China?
Oh, how glad I am that I got out of that shithole.
From the Koa homepage:

> Koa is a new web framework designed by the team behind Express, which aims to be a smaller, more expressive, and more robust foundation

I think he meant successor in the spiritual sense, which is undeniably true.
Okay, valid point, some already do. But that doesn't change the case that _all_ of them should be doing it whenever possible.
Ahh, very good. Then perhaps our target of inquiry ought to be the IsString class. Ought it have some laws we can expect instances to follow, akin to the Monad laws? At the moment, we can write:

instance IsString () where
fromString = const ()

And there's nothing wrong with it!
Credit Card-Reading Spy Camera Found in the NYC Subway
Binary MRI rubies statically linked to vulnerable OpenSSL
It is a little crazy in hindsight. I mean - who did I play D&D with? The other nerds who also never got in trouble. We were by and large the teachers pets.

I remember meeting a cop at GenCon when this hype was happening, and he said, "The stats suggest that D&D players commit crimes at a miniscule level compared to the general population."
They profit in changing lives.
It's Theo de Raadt...

It's possible that he knows of a real exploitable problem.

It's possible that he is trying to boast about his prowess with things "security".

It's possible the "hole" is a design feature in FreeBSD that he just doesn't like. (And hence, considers to be a security problem.)

It's possible that he is bitter that FreeBSD has gotten more attention than OpenBSD.

It's possible that he said it to spur FreeBSD take more interest in security. (Justifiably or not...)

It's possible that he wanted to cause a commotion.

It's possible that more than one of the above is true. :) He is under no obligation to make a disclosure of an exploit that he finds. Does it make him a bad net-denizen? Perhaps. But it's his prerogative.
That maybe true, but you're also making the assumption that other SSL/TLS implementations are not already better.

The recent OpenSSL bug is a great reminder that we shouldn't just used OpenSSL because it's what everyone else uses. It's an excuse for use to investigate alternatives and then make a rational decision about which implementation to use. If that investigation leads us back to OpenSSL, then so be it. But without looking into competing libraries, any talk about OpenSSL being the better stack is pure speculation.
I use Twitter to get news and updates from a few sources. And in this case, the headline is like saying the majority of newspaper readers have never written a newspaper article.
Most of these are new to me, though I have really enjoyed Bootstrapped.fm so far. The guys are not shy about sharing their doubts (e.g. whether SaaS is the right way to go for everything) and that's really refreshing.
BitScope Micro, built especially for the Raspberry Pi
5 mistakes I made launching a startup
Is that last question typical of interviews in the States? What is it selecting for? Aptitude in Maths?
Was thinking about this as an alternative to existing password managers. The advantage is as you say your passwords aren't stored anywhere, even in encrypted form, and can be retrieved as long as you remember the master key and algorithm, but the disadvantage is that you're essentially sharing a poorly-salted hash of your master password with every service you log in to. I'm going to go for a password manager for now, simply based on my perception that they're widely used by people who know more about security than I do.
I think that's more generated outrage spawned from a place of immense disenfranchisement than generated fear spawned from a place of wanting desperately to belong to the cultural group you identify with.
Charging to use it would likely constitute distributing it, so I doubt that would fly. Having it on a server backend seems OK though.

But what GS did - use it in their own trading system which isn't consumer facing, and is used only by GS is perfectly allowable. And it's even within their rights to prevent the code from being released.
Was there a similar religious scare about them in the 90s? I was too busy avoiding my parents and being a teenager at that time to know.
Why? If you use a password manager, the cost is minimal.
Or have policy of replying with humor and bounties. So the rest of the world happily finds your vulnerabilities for you.

Works for small, old, etc products as the value of breech will probably be less than value of bounty + cred.
The interesting thing here is that the part has been substituted with another part that's comparable in quality and only slightly less expensive. The margins for counterfeiting this part can't have been very good.

It's pretty common to counterfeit electronic parts. I've come across counterfeit op-amps, exotic transistors, power transistors, ordinary transistors, capacitors, and even fake resistors which is amazing. It always just makes me wonder what is wrong, collectively and institutionally, with China? Making counterfeit goods of all kinds is apparently a common line of business in China. Is it just because _everything_ is made there so counterfeiting has proportionately shifted there as well?
That vulnerability does not sell for 10x on "the black market".

* It fits into nobody's existing operational framework (no crime syndicate has a UI with a button labeled "read files off Google's prod servers")

* A single patch run by a single organization kills it entirely

* The odds of anyone, having extended access and pivoted into Google's data center, keeping that access is zero.

I'm not an authority on how much the black market values dumb web vulnerabilities but my guess on a black market price tag for this bug is "significantly less than Google paid".

Later: I asked a friend. "An XXE in a single property? Worthless. And at Google? Worth money to Google. Worth nothing to anybody else."
Yup, we know...boy do we know. :) Rationally, and per our FAQ, we considered ditching it because the economics are marginal or worse. But neither Jose nor I could let the idea die. We hope the latest version hits the right combination of OK economics, and strong benefits for everyone involved.
Remember that VCs have money to spend on acquisitions for their investors, not for themselves. It's very rare to see VCs acquire talent for themselves. It's usually personal network based hiring. What makes this unique is that it's a talent test first - groundbreaking in an industry that normally hires based on personal connections.

The real question is "What problems will these folks be solving?"
How can they sell an exception to the GPL license if they're accepting Pull Requests on Github. I haven't seen any reference to a CLA.
I thought it was pulled because one VLC contributor, holding authorship and copyright on parts of the code (and also happened to be a Nokia employee, hmmm...), had an axe to grind and demanded the takedown?

Also, if you own the full copyright on a given app, there shouldn't be anything stopping you from releasing it as gpl on github while also licensing it for free download on the appstore - you get to pick the terms of redistribution as you like for each individual distribution point.
The "stream" concept only works if you have a lot of followers, which most people do not. For those with < 200 followers the chances if anyone reading your tweet before it falls down the stream is so small that it becomes a waste to even try.
Id suggest "Thinking in Java", "Effective Java" and to get OCJP training material and start doing that.

Can you implement the 10 guesses game? You know, computer picks a number between 1-100 and asks you to guess, then it tells you if its higher or lower. Do this in a simple Java class, static main, play from console.

Then do that same program but this time as a web page and using JSP, for this step itll require a lot. You have to make a Java project in Maven and deploy it in tomcat. THere should be a button to "enter" the guess.

Now when youve done the above exercises, redo it and this time secure it, and use ajax, no page refresh.

Now for the last exercise ask for the users name before gamae begins, and save every game the user plays to a database of your choice, I suggest PostgreSQL, and let any user see what other users played, like a replay of the game.

Make it as ugly and as wrong as you can think, dont care, just do this.

Now when you have done the above and have a webapp made with Java, JSP and simple JDBC, where user can play in its browser, see historical games and so on, add a counter "This many users are playing right now".

Next month, make a computer play the game you made. First code it to play against the console version, then against the web one, you can make an API or WebService to play it.

Now when youre done, come back in a month or two and ask again.
Not everyone is going to have regrets about stealing from friends. Wozniak is just being generous.
Thanks for sharing. It's amazing what a small group of talented and engaged employees can accomplish.
I can completely understand your sentiment, but for some reason I continue to find the man to be more and more fascinating.
Yes, that's about the only way I finish projects. I try to make very short-term milestones.
You can use a cryptographic hash on it. It's how SuperGenPass works: http://supergenpass.com/

(Personally, I use an homegrown script that runs outside the browser, but does something similar)
I'm curious about the opposite -- I'm assuming it likely keeps dead weight around longer too; someone who isn't happy or motivated, waiting around for a few months for the 5k bonus for leaving.
I'm thinking about applying but 2 months is a bit long for me. One month would be ideal. Is it possible?
I assume that some (probably small) proportion of this 44% has used their account for direct messages, DMs, but these can't be detected? Also, how are protected accounts factoring into these stats? I couldn't find a link to the data itself and the article didn't make it clear how these two factors are being handled.
Brilliantly done! Great to have this out there to help explain the issue to non-developers.
We do it because we want it to exist. Getting past troubles in programming is much easier if you have people around, go for lunch, etc... who are pretty advanced. You are right that it's challenging to make it sustainable as a business. We are putting in serious hours (I'm fulltime on it since Nov 2013, and Kai is ramping up since he joined; he has his own clean energy startup to take care of too!). We do want Hacker Retreat to make meaningful money so it compensates the time invested, if anything. But this is no aim-for-the-moon startup.
Thanks! We think at least a few people from our last Fall batch would agree to that. We're intending more people to say that when this next session/batch is done.
What Can App Developers Learn From Heartbleed?
View From Above: Russian Forces Near Ukraine
3D Printed Letter Press
It's going to be an even bigger hit than express, for sure.
It's actually GPL-2+, but yes, this unfortunately limits the scope of outside contributors.
Growing up through the D&D panic and experienced the first-person shooter makes you a killer or GTA makes you violent nonsense, nothing recent compares to the D&D panic.

There's a severe difference between people thinking a video game will make you anti-social, violent, or a killer and people being concerned over your immortal soul. Keep in mind, D&D was going to make you summon demons, have blood sacrifices to pagan gods, commit suicide, and then after all that evil you were going to burn in Hell forever.

As there is something to what you say in comparing environmental panics but most of the time that was often based on something real that was then overblown, taken out of context, or misunderstood. Acid rain and the ozone hole turned out to be not as bad as some were predicting, but they were real. Summoning demons is not.

That and the more recent nonsense over video games possibly causing anti-social behavior cannot even come close in comparison.
As an American citizen, at least half of my employers have had at least one immigrant founder— immigration seems like a big contributor to the US' excellence in high tech. But H-1B visas aren't great for me, since they give so much more leverage to the employer and not the employee— just giving green cards or work visas to skilled immigrants would be much better.
What if Walter White had Life Insurance
No, that's not how it works. If it was like that, that would make their teams less productive and Amazon wouldn't do it.
What some one - I think kibwen - has brought up is that early adopters can benefit in the sense that the language design is still in flux. So these early adopters can uncover weaknesses in the design, before they get to the stage where they have to consider backwards compatibility.

So although early adopters might not get any useful software out of learning Rust at this stage, they might indirectly improve their future Rust code by having a small influence on the direction of the language.
Make sure you read their license, it could be slightly modified GPL. Some licenses (such as Apache 2) has clause which makes any contribution Apache licensed.
Pre-order your .NINJA domain name
My wife still gets redirected to that page from retail.santander.co.uk on entering her customer number.

It doesn't automatically indicate insecurity, but it does indicate that there is a system that isn't being actively maintained properly but is still up.
I'd not stop you, but once your are here, I'm pretty sure you'll be sorry that you can stay only one month... apply though.
Boring constant revenue is the small stuff that many dreams are made of.

You have the kind of startup that I would love to have, what some call a lifestyle business.

As other posters should have stated, there should be some way of making it run at a surplus (that is you with minor supervision + manager + employees).

Is it software based or is it more towards IT service, where if you stop coming for a month you will not get any revenue?
The Netherlands even gives you a tax discount for 10 years if you're a highly skilled migrant, the criteria for being able to apply for it basically comes down to "is this person likely to need welfare? No? They get lower taxes then": http://www.expatica.com/nl/finance_business/tax/The-Dutch-30...

It makes sense for states to enact programs like these for the reasons you pointed out. If you can get skilled migrants you get net contributors from day one.
How do they get such high resolution? An electron microscope or something? Such a cool blog, I've seen it featured on HaD a few times.
take away: XML should not be used (at least as user input). It is too powerful, too big. It is much too hard and expensive to test and validate.

Input from potentially malicious users should be in the simplest, least powerful of formats. No logic, no programability, strictly data.

I'm putting "using XML for user input" in same bucket as "rolling your own crypto/security system". That is you're gonna do it wrong, so don't do it.
This isn't a root exploit. It serves up files that are readable by the serving process, such as /etc/passwd. You are aware, I hope because it's been this way for 20+ years, that despite the name there are no passwords in /etc/passwd, right? It's not considered a sensitive file.

% ls -l /etc/passwd
-rw-r--r-- 1 root root 2028 Dec 2 13:05 /etc/passwd