skysight-inc/HackerNews huggingface dataset:
Several certificate vendors reissue certificates with the same "not valid before"/"issued" date as the original one.
I already learned three new things, and I only skimmed a couple of articles. Thanks, I'm going to save this for use over several weeks of lunch breaks
It was a company that went through several iterations, like many startups. The latest iteration was built on a recurring revenue model for professional development training targeting Millennials at work. Think Lynda meets CreativeLive for people under 35 trying to figure out how to navigate the professional world, especially within corporations and agencies.

The shutdown was a direct result of misalignment of vision with our main investor.
I half-assed this once and just made postfix check spamhaus and spamcop. Very little spam gets through.

I'm thinking about turning on greylisting as well, but right now its not needed.
Not exactly - I see it happening sporadically based on the expected longevity of the project, more this year than last.
I'd say watch this TED talk first on Motivation (if you haven't already): http://www.ted.com/talks/dan_pink_on_motivation
Its 18 minutes but a very important 18 minutes to spend.

Once you watch this, get a better sense of what any company is like with respect to the concepts Dan mentions in the talk (ie Autonomy/Mastery/Purpose)

Ultimately, if their philosophy aligns with what Dan says, you're odds of being intrinsically motivated are much higher which by definition means you will be happier.

I can't think of a better framework to get a sense of how happy you might be in any job.

Hope that helps
Schneier.com Is Vulnerable.
You can run `go get github.com/titanous/heartbleeder/tls`. Then `go build` will create a static executable called `heartbleeder`.
If I was an attacker able to get packages in Ubuntu compromised I wouldn't be going after KeePass. I would go after a browser, a random utility normally run by root, or the kernel itself. If Ubuntu is giving you poisoned packages, you are hosed. Game over, no security.

You "know" that Ubuntu is not distributing rogue packages because the author of the package and the Debian package maintainer are different people. Presumably the Debian package maintainer peer-reviews the code they are including in the distro for security issues, and puts their name and reputation on the line (hence the Debian maintainers' signatures on the distro itself).

What you are really asking is "how can I trust code written by other people". You cannot. If you are taking the paranoia to this level, then don't use computers at all. We do not have a system in place for not trusting the OS, or the hardware. You must put a line in the sand somewhere and say "I trust these people". Otherwise, you cannot even trust your `cat` command to review the source code of the software you want to trust, and you'd have to spend more than your lifetime reviewing every bit of code you are currently using to read HN in order to know for sure that it's secure (assuming you are able to spot all malicious, or just insecure code).
Distributions like Ubuntu are not picking up and distributing random packages from the Internet. Usually it's either the software author that does the packaging by himself, or a package maintainer that has a direct relationship with the software author.

Encryption/signing is only for proving that the source is who it claims it is. It doesn't mean that you can trust the software itself. Towards that end you've got source-code. Ubuntu's software packages are built from source and you can inspect it - yes it may not be feasible, leaks may escape even trained eyes and so on and so forth, but the source-code is there available for inspection and nothing short of a source-code review can prove that the software does what it claims.
Hi, Heroku engineer here. We rekeyed our certificates, including the one for *.herokuapp.com, meaning we resent our original certificate requests (CSR) to our CA but signed with new private keys. This is why the dates didn't change.

Our CA will eventually revoke the previous incarnations of our certificates, signed with the old private keys, making them invalid.
World's largest single crystal of gold verified at Los Alamos
I manually created a new ELB which seemed to have been fixed and then updated DNS.
User data is useful for showing ads that convert well, but the fundamental unit of value in consumer apps isn't data, it's attention.
Seems to me they would apply to Javascript though, and that got quite fast with V8.
Competition is great. It will help both of these companies refine their product and that's awesome for the users. That's the point of this article, but all I can think is:

But damn does the Uber CEO look like a cunt.

There's absolutely no reason to treat your competitors like that in order to feed your tough-guy ego.
I am the author of this article, and I'm happy to answer any questions about tech consulting right here.
Don't forget RethinkDB. Very good general-purpose document store that supports joins and has an excellent query language (no DB write lock either!)
Google kills fake anti-virus app that hit No. 1 on Play charts
Microsoft kills Farecast airfare price predictor, to the dismay of its creator
Sounds a lot like anti-sec to me...
I think that one solution is to make being a prosecutor a political dead end. In other words, convince the public to never, under any circumstances, vote for anybody who has ever been a prosecutor (except perhaps if the position in question is prosecutor, though excluding this exception would be creating de facto term limits which might be a good idea anyway...).

That way somebody only becomes a prosecutor if being a prosecutor is what they actually want to do with their career in public service. It would not be a stepping stone for a further career in politics.

If term limits (de facto or de jure) existed for prosecutors, that would put the brakes on prosecutors optimizing for conviction rate.
> Ruby permits adding methods to individual objects; in Smalltalk, all methods reside in classes.

All Ruby methods reside in classes, too, "adding a method to an object" is really adding it to the object's singleton class (metaclass).

The difference between Ruby and Smalltalk is that in Smalltalk, each explicit class has an implicit metaclass (a class in which the class's instance methods are defined), whereas for Ruby each object (including, but not limited to, class objects -- and notably including other implicit metaclasses) has an implicit metaclass (often called the eigenclass).
That is assuming you can trust your tools, OS, and hardware to show you the real source code :). How do you know that your editor or your compiler are not messing with you? But yes, you are correct.

BTW, in the case of Debian, software authors are discouraged to package the software themselves and instead are encouraged to work with maintainers instead. I see this as a net win as there is at lest one more pair of eyes on the software before it ends up on my machines.
8 tips for giving the perfect investor pitch (from someone who’s raised $75M)
My dad was paralyzed from the chin down by a spinal cord injury for the last six years of his life, so I follow news about treatments for such injuries with great interest. The article reports, "But patients shouldn't expect that the stimulator will help them walk -- at least not now and maybe not ever. The stimulator can only make one leg work at a time. Patients have to turn the stimulator off and then back on again to make the other leg work or to make another set of muscles such as their torsos work." That sounds like a rather significant practical limitation, so far. My dad had contemporary (2002-2008) physical therapy and other treatment, including electrical stimulation, after his injury, but he died having never walked and never scratched himself in the years after his injury.

I'm trying to find scientific publications about this now that I've read through the article. I see from 2011 the article "Effect of epidural stimulation of the lumbosacral spinal cord on voluntary movement, standing, and assisted stepping after motor complete paraplegia: a case study" The Lancet, Volume 377, Issue 9781, Pages 1938 - 1947, 4 June 2011 by Susan Harkema (the doctor quoted in the news story) and several colleagues.

doi:10.1016/S0140-6736(11)60547-3

http://www.thelancet.com/journals/lancet/article/PIIS0140-67...

The spinal cord injury reported in that single-patient case study was between the seventh cervical vertebra and first thoracic vertebra,[1] and that location further down from the brain makes for a more favorable prognosis than the second cervical vertebra injury my dad had. Those injuries can be quite devastating, and there are a lot of active research programs on how to treat them.

Spinal cord injuries vary in their severity according to where along the spinal cord the injury occurs and how severe the injury is. (A severed spinal cord is a rare outcome of most commonplace injuries, but there is so far no prospect of healing a severed spinal cord. The patient reported here, and my dad, had bruised but not severed spinal cords.) I imagine quite a few doctors at research hospitals are already attempting to reproduce the results reported by Dr. Harkema's team. I hope they enjoy much success.

[1] https://en.wikipedia.org/wiki/Spinal_cord_injury

AFTER EDIT: The link to the current publication

http://brain.oxfordjournals.org/content/early/2014/04/07/bra...

kindly shared in another comment in this thread doesn't seem to have a paywall for this article. At least, I appear to be seeing the full text even though I am not accessing the article from a computer with institutional credentials.
Your 58-Word Cloud Vocabulary Test: Test your geek-speak
This guy is a domain squatter, maybe its just payback.. in some ways been ripping off other people.
Show HN: Sticky Alerts
an old one, but the circumstances arise so often (app updates) and the consequences so severe (shark attack!) that it's probably worth posting:

https://xkcd.com/349/
Needs Parrot and Javascript in there somewhere though, for maximum coolness factor.
A talk on Game Design by Brenda Romero
Being the one widely supported client-side language for the web means that lots more money has been poured into making JavaScript implementations effective than has gone into Ruby (I wouldn't be surprised if Google put more resources into V8 than have gone into all Ruby implementations combined.)
> if I had started coding as young as the children in the video, I don't know if I'd be as jazzed about it as an adult.

I don't see why this is a bad thing.
University of Utah Announces Gift for Transformative Entrepreneur Building
Everyone should assume the website they use is vulnerable to Heartbleed, and should wait for a public post-mortem.

Of course, sometimes, servers are randomly protected, such as nodejs servers and IIS: https://github.com/joyent/node/commit/28c6e42e
Couple of comments on the openssl heartbeat fix.
Couple comments when looking at the ssl heartbeat error patch code:<p>http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=96db9023b881d7cd9f379b0c154650d6c108e9a3<p>+ if (1 + 2 + 16 > s->s3->rrec.length)
+ return 0; /* silently discard */<p>1) Instead of "silently discard", wouldn't be a better idea to log so the server/ops team can easily see where the attacks come from or to know the server is under attack.<p><pre><code> Maybe at lease as compile and/or config options.
</code></pre>
2) Such critical code fixed/checkin doesn't have any corresponding test coverage code.
The only point I'm making, and I hope the other guy reads this as well, is that keepass isn't as bullet proof as people act it is when criticizing last pass. It has its problems, just like last pass. I was simply playing devil's advocate.

It's very much the "Oh I don't get viruses I have a Mac" argument that I've heard a lot of non-computer people say. This is undeniable because I'm sure many windows keepass users go to the site every download.
Everyone should be adopting perfect forward secrecy in their TLS connections. No excuses at this point.
Weird. Can you try "openssl version -a" on both? Like this:

$ openssl version -a
OpenSSL 1.0.1 14 Mar 2012
built on: Mon Apr 7 20:33:29 UTC 2014
platform: debian-amd64
options: bn(64,64) rc4(8x,int) des(idx,cisc,16,int) blowfish(idx)
compiler: cc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN
-DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -g -O2 -fstack-protector --param=ssp-buffer-size=4
-Wformat -Wformat-security -Werror=format-security -D_FORTIFY_SOURCE=2
-Wl,-Bsymbolic-functions -Wl,-z,relro -Wa,
--noexecstack -Wall -DOPENSSL_NO_TLS1_2_CLIENT -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50
-DMD32_REG_T=int -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5
-DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM
-DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM
OPENSSLDIR: "/usr/lib/ssl"

In any case, it could be that something else (not built with OpenSSL) is listening on port 443 in the one that's "safe".
If you're maintaining sites that are difficult to upgrade, I'd recommend looking at IE11 Enterprise Mode. It lets you run with pretty good IE8 compatibility (e.g. ActiveX) in IE11, taking advantage of improved speed, security, and base OS improvements.

20 slide deck: http://view.officeapps.live.com/op/view.aspx?src=http%3a%2f%...

docs: http://technet.microsoft.com/library/dn640687.aspx

good blog post: http://love2dev.com/#!article/The-New-Internet-Explorer-Ente...
Ubuntu Security Notice USN-2165-1 (Heartbleed)
>> the smartphone emerging as the platform of choice vs the desktop browser

> This is repeated from blog to blog but is it really true?

Just an anecdote: In our household, we have multiple tablets, laptops, and a mid-tier desktop with a huge beautiful screen.

My wife prefers 99% of the time to do everything on her iPhone 5s.
There is no information about SSH on this page. OpenSSH is a program depending on OpenSSL the library, specifically OpenSSH uses the libcrypto part of OpenSSL. So after updating OpenSSL ssh service should be restarted anyway.
Snowden; video link with members of the Council of Europe
> When I'm around people who use a smartphone, I never see them engaged in anything more complex than listening to music, texting, or playing some super-simple game such as CandyCrush; they're never "browsing" anything, searching, writing, composing, etc.

The thing is, for the vast majority of people that's all they were doing with their PCs anyway. They weren't composing librettos, they were just checking email and playing Farmville. So to them it doesn't feel like they've lost anything.
Conference and Expo for the Fast-growing Bitcoin Industry
Maybe it will be easier to look through the Snowden documents for this, now that we know about it, and see if they had it.
List of Heartbeat exploit proof of concepts
Bitcoin "solves" the problems behind Byzantine fault tolerance, quorum systems, etc by completely ignoring the past 30 years of research on the topic, and introducing a very simple construction that bypasses all of the issues entirely by using the concept of proof of work. Don't get me wrong, Bitcoin is a brilliant idea, but it's the sort of brilliant idea which is actually more likely to come to you if you were NOT bogged down by existing research on how to do things. Satoshi's primary gift was not deep knowledge, it was a fresh perspective.

And I am not saying these things because Ethereum is a super-magic-brilliant protocol that involves deep knowledge about thirty years of development in multiple fields; it's not. It's also an ultimately fairly elementary idea that I still remain surprised that nobody tried to seriously push before me. In fact, at least two other groups got very close in 2012-2013, and a few weeks ago at the payments innovation conference in Boston I learned that apparently the concept sans blockchain was around in the 1990s; but for some reason they did not take the idea to its logical conclusion.

Also, our implementation of GHOST does not in any way compromise the concept of global state; blocks are required to specifically include uncle headers in order to benefit from them.
See this post for a trivial example of session theft from JIRA [1]. You may not get the memory chunk you want the first time, but you can repeat it until you do.

[1] https://www.mattslifebytes.com/?p=533
Your example doesn't demonstrate the ly suffix in English, incidental.ly.
But a Stripe account is still required..that means its US only (or limited countries where stripe is available), correct?
I would memoize with an alias_method wrapper and let it hit a cache_hash before calling the original function. This is a generic pattern that should work for all immutable functions.

http://stackoverflow.com/questions/21790868/simple-aspect-or...
If ignore the 2048 hype and how well that's built framework-free, this is one of the most excellent writeups on how to build and organize an angular application that i have seen to date.

Seriously, screw TodoMVC. I cannot get a feel for a framework from that. This is almost the minimum complication level you need to be able to assess a framework's usage complexity.

The animations need work though, the feel of the game is less polished than the original, mostly because the original game keeps a copy of the most recent tile floating on top of the one that's merged away so that the full animation can run.
It is not much help the first year, but on campus jobs, specifically in housing can help a lot. It can cut $10-20K/year down in cost.

Room and board is typically the highest expense after tuition and if you can cut that down to nothing it can go a long way.

It also doubles as a great way to meet people who are working their way through school.
> Childhood should be about goofing off on tricycles, playing tag, and creating awesome Lego towers from a big box of blocks. I love programming now, but if I had started coding as young as the children in the video, I don't know if I'd be as jazzed about it as an adult.

I spent my childhood doing all those things -- including programming from a fairly early age. I'm still jazzed about it as an adult. In fact, moreso than lots of people I know who do it professionally, but got into it later.
Netflix starts to stream in 4K
Agreed that cloud services may be using OpenSSL to transfer the KeePass database to/from the client. Presume an attacker obtains the KeePass database via a MITM attack on communications to/from this cloud service. Then what?

The attacker needs to penetrate the defenses of the KeePass database itself, so I'm unsure of the point you're trying to make with KeePass and cloud services.
Nice App.
Question for author and others on HN:

How feasible is it to have remote employees when most of your work is on embedded systems?

I recently started a software consulting group with a couple of partners, and we are starting to hire. I'd like to offer remote positions, but since most of our work is on embedded systems (e.g. medical devices), I don't think this is really feasible. For any given system, there's so much pain in wiring, setting up and debugging a test and development environment, etc. that it doesn't seem worth it. However, maybe I'm overestimating the difficulty and underestimating the benefit. Anyone else have success with remote work that is not primarily on web systems?
How Automation Left Us Feeling Empty
Atlassian Valued at $3.3 Billion
This comment is better than 99% of the media coverage I've seen so far. Who announces a crucial SSL vulnerability that affects Twitter, AWS, Steam, Yahoo and Dropbox without notifying them first? They are making a name for themselves by exposing private information of millions of internet users.
Also, I find it interesting that the vulnerability was discovered by Google's researcher and some of their main competitors weren't notified about it.
I had similar issue with my email account. The password is only used for that specific service and I got a notification yesterday that someone had tried to access the account with correct password.

Coincidence, could be. But probably not.
Thanks! It might be reassuring to others who see the same mixed-signals if the official blogpost made specific mention of APPNAME.herokuapp.com HTTPS, and that the certificates may look older but really are fresh.
Given that Discourse is an Ember.js app at heart, I wouldn't bet on that anytime soon.
IE6 Countdown
"Quorum contracts" could also be a thing - contracts that exist solely to aggregate data from multiple sources, so you don't have to request data from each source every time you want to check something.
My understanding is that even with their web login process your password isn't sent to their servers in plaintext. From the comments on their heartbleed blog post: "We only use one-way salted hashes (after going through PBKDF2 rounds) to send to the server for authentication."

So their servers get a hashed version of your password, but not the password itself. Their servers likely also store a hashed version of your password so that they can authenticate you. This style of auth is also used when you use the "show me the password" feature.
Check out drip?
The website and extensions are mostly JavaScript, so you can audit the code yourself if you wish. LastPass does use a proprietary plugin for some features, but they have a binary free version for most, if not all browsers.
> but with a landing page like this

You mean one of github's default landing pages for projects? http://i.imgur.com/nQgmrE5.png
> I don't think intentionally preventing the programmer
> from doing certain things the computer is capable of
> doing on the theory it makes errors impossible makes
> sense.

With arguments like this, we'd all be back in the days of non-structured programming languages (enjoy writing all your crypto in MUMPS). Every modern language, including C, restricts itself in some way in order to make programs more predictable and errors less likely. Some simply impose more restrictions than others, though these restrictions can actually make programs more efficient (see, for instance, alias analysis in Fortran vs. alias analysis in C).

> somebody has to deal with the pointers and raw memory
> because that's the way computers work

All three of the languages listed previously (Rust, Ada, ATS) are systems programming languages with the capability of manipulating pointers and raw memory (though I don't personally have any experience with the latter two). What they have in common is that they provide compile-time guarantees that certain aspects of your code are correct: for example, the guarantee that you never attempt to access freed memory. These are static checks that require no runtime to perform, and impose no overhead on running code.
Protean clojure/edn RESTful API simulation and testing
Holder: Bitcoin raises law enforcement concerns
But isn't it because they're big & complex that it's more difficult to quickly resolve ... on the other hand, since they're so big & important (and have the means) they should have plans in place already to deal with such things.
Century Link is a big ISP...thing. Savvis is part of it and they apparently resell things like Verizon and Comcast. The labs seem to support their hosting business.
Would you really give advice to hold the court in contempt?
Single Address Space Operating System
Usually the algorithm is described in another document without several expressions & lines. "Readability" in some of these contexts means verifying that you've correctly typed in the expression.