skysight-inc/HackerNews huggingface dataset:
There have been a few bugfixes. Some insecure idioms have been corrected, a broken implementation of calloc (seriously, why?) has been replaced with calls to the library function. Some deceiving (and/or just useless) wrappers have been eradicated. More significant is the removal of the built-in RNG and a few hilarious (or sad) questionable "features" relating to its use.
Ask HN: How do you prepare a site to handle being on HN's frontpage?
I'm sure we're all familiar with sites making the front page of HN and promptly going down under the traffic load.

I'm wondering if anyone can point myself and others to a list of best practices to prevent such a thing from happening.
It is a nice idea, but in your two simple cases the photo would be of a "ubiquitous" Xbox 360 and a iPhone 4S. But it could be of an iPhone 4 and in the case of the Xbox the date of manufacture really matters. The older model that _will_ one day die on the owner are worth less. And then there isn't any mention of how much space you have on them. But above all a photo might not indicate if the device actually works...

Would you be mad if your barely used unlocked 64GB iPhone 4S was sold as a non-working locked 8GB iPhone 4 and they send you a check for $10?
Or, to play devil's advocate, that you aren't putting in the level of work in your day job that you could be putting in. If I were an employer looking at a candidate and I saw they had huge amounts of open source contributions, the first thing I'd ask is "how did you have time for this and your day job?".

It also tells you something else about a candidate: that their previous job probably wasn't particularly hard or that they didn't have much in the way of responsibilities. If you're the lead developer on a several hundred thousand line codebase, it seems less likely that you have time to build an open source resume than if you were a junior developer.

Honestly, I think open source is a bit of a mixed signal. If the code shown in the repositories is great, then that's fantastic, but if it's merely average then I think it makes you look worse than just not having it there at all. This is really my biggest objection with open source: if you want to use it as some sort of resume, then you have to contribute huge amounts of time to it in order to make it representative of your skill. Then it's no longer an open source project you do for fun, but just a second day job. Additionally, when it gets good enough for an employer to see, what interviewer is going to have time to read through it? This problem is magnified especially when developers start treating open source as a form of resume, and interviewers have to wade through shockingly poor repositories from every candidate to determine the candidate's quality.
volunteers time does not scale.
What video is that, "how to completely not understand the way a society works and that you are part of a society"?

Edit: The video presenter says "don't pay taxes, don't follow laws".

That's like not getting your children vaccinated - a benefit for you in the short term, assuming nothing everything else stays the same. All other people are vaccinated so there's nobody you can catch the disease from anyway. Most people pay taxes so there's no degradation in the local life, but you have more money and more choices.

But if there were no taxes and no law for everyone, you wouldn't be able to do that. Rule of law keeps buildings built to a safe standard, keeps food edible, keeps water drinkable, keeps airlines basically safe, keeps employers from abusing employees with low wages and no safety codes, keeps businesses from wrecking and polluting the local town/city environment.

How much are you really going to be able to keep of your earnings if you have to personally guard it 24/7 because there's no police, no law, no way to stop someone stronger taking it without followup, and no banks you trust?

And how much is that money going to be worth anyway if there's no government to say that it has value by fiat? Who will take your money if they have no guarantee anyone else values it?
It might not help upstream OpenSSL, unless they keep an eye out for the bug fixes. Consider OpenBSD the upstream for this new fork.
Online revocation is pointless. It sounds like you didn't actually read the article, but are happy to slam the one team on the Internet that has given serious consideration to the obviously-broken SSL revocation system. Can I ask you to take a breath and reread the article?
Real time? Good comebacks are immediate. Taking just 5s to consult your phone and deliver the comeback is just going to give the other guy more ammunition
Yes, You Too Can Be An Evil Network Overlord
Ok, so suppose registering a domain also required registering a public key for the domain name. This would require a change for the root realm. Suppose we were to extend the DNS protocol so that when you do an NS lookup, you get the keys of the NS's as well (might require SRV records or the like in the root tree). You'd need a mechanism to revoke or rotate keys, but that could be done.

From there it should be quite possible to tie public keys to hosts all the way down since you now have a chain of trust. Should be trivial, but the problem is that I don't see how to get the root zone to publish domain keys.

Yes, that replaces CA's with domain registrars, but that is a healthy trade. Since you would get keys (all allowed keys!) all the way down with your query, you wouldn't need to check revocation because you'd know the keys before making the connection.
You know, as an end user, I'm getting kind of tired of the "The engineers were told to do it wrong by those mean, nasty managers! It's not their fault!" excuse. The people writing this software are presumably grown-ups--professionals who need to start taking some responsibility for the crap they shovel out into the world.

If a construction engineer built an apartment building that he knew was going to fall over, his PE license could be suspended or revoked. It doesn't matter who told him to do it.
Do you know the limits of "soft-fail"? Because I don't see you addressing them.
Check out The Best of Email's Inspiration Gallery for subject line ideas
"Playing with your kids" is not mutually exclusive with doing open source work. Linus Torvalds (of Linux fame) is a father and so is Doug Cutting, founder of Hadoop.

"Doing research" is not mutually exclusive with doing open source work either. In fact, I think these days, I would be suspicious of a systems software research project that didn't release the code. A lot of systems software research projects use Linux or some other open source code base as a starting point, since re-inventing the wheel is not very conducive to publishing quickly.

It's pretty obvious why companies would want to look at open source contributions. They show that someone works well on a team, is motivated, and can write code. Of course, they're not ever going to be the only thing companies consider.

It's not even that they don't work on projects in their spare time. They do, but they're not part of open source culture, where people share things by default. They're satisfied with having made the thing itself, and they're not going to put their hardware or software project on github any sooner than they're going to make a website for the house they built from scratch.

How do you know they work on projects in their spare time? Is it because they shared them with you?
But it makes it readable, which makes it easier to find bugs. This is vastly more important.
Have it work offline to avoid massive roaming charges.
This does exactly that and you don't even create an account, so it's really anonymous: http://www.gosoapbox.com/ . All you have to get is a shared url for the dicussion. Their primary use case is for classroom discussion, but functionality is what you described.
I don't think they intend to contribute back to the original OpenSSL code base, but see this as a OpenBSD only fork.
"The present data are based on country averages,
and the specific chocolate intake of individual
Nobel laureates of the past and present remains
unknown."
Repeat from https://news.ycombinator.com/item?id=7611093 (just a day ago)
Registered agents as a service. Right now hiring people out of state is a pain, despite how popular remote working is getting. There are a lot of random rules in each state, and you have to have a registered agent in a state in order to hire in that one. There are a few services that do this, but they do it poorly and not in the typical startup fashion we've come to expect.
No I'm not aware of any. Though it's not hard to build something like that (in theory).
Wow, thanks. I just cloned, built, and ran it on Mac. It really works well. That was too easy.
at Codeship (I'm one of the founders) you can run your tests and use our app engine integration to push whenever your tests pass. Setup takes a minute. let me know if you have any questions at flo@codeship.io
I don't think the changes they are doing at the moment have much security value. They aren't working on fixing OpenSSL security flaws. They are obliterating all the layers of cross-platform compatibility that make the code more complex, and removing everything OpenBSD isn't likely to use.

They are transforming a local copy of openssl that tracks upstream changes to their own fork, that probably won't reunite with the upstream version anytime soon.

In the process, they are obviously likely to find some bugs (and they already have fixed one or two harmless ones), but I think they are more interested in building a clean fork for themselves than in fixing the upstream openssl.
I'm not even allowed to share my my custom portfiles. I started to, but was asked to hold off; that was 2 years ago.
Looks like significant amount of non-stylistic changes too:

http://opensslrampage.org/
man style

http://www.openbsd.org/cgi-bin/man.cgi?query=style&apropos=0...
> Online revocation is pointless.

So is getting a subset of revoked certs Google deems "valuable." In fact, that may be even more dangerous since it establishes first class secure sites vs everyone else.

Why should Yahoo's cert revocatins get in the CRLsets but not less well known sites? How is that less broken than online revocation?

Keep in mind, my big objection is:

Google did not distribute our certificate vocation in their CRLSet, presumably because we weren't large enough. That is not a fix for anything.
It's not overwhelmed. There must be a bug in my web server!
As a general rule, people care that their connection is secure, because they've been told to worry about people stealing their card numbers on insecure sites. They've generally established trust in other ways - more commonly, they simply trust it because they've heard about it elsewhere or it ranks highly on Google, and they use a trusted payment provider such as Paypal.

Most people honestly don't go to the effort of verifying that a certificate matches the real-world identity they think it does. It's difficult, especially with smaller stores that don't use EV certificates.

For cases where people think third-party attestation is a necessary thing for their purposes, frankly, we have nothing better than the CA model right now; but that can easily be integrated with Namecoin, allowing for only those who need it to use it, and the rest to have access to secure communications and proofs of digital identity without having to pay up.
Yes. This was demoed at the GCP Live event a few weeks ago. I don't know if it's included in the public offering yet.

Some blog coverage here: http://blog.cloudbees.com/2014/03/jenkins-man-behind-curtain...

(Note: I work on Cloud at Google, although not on this part of it. Thus I'm going to be a little conservative and only discuss things I know we've announced)

edit: Oooooh, or just ask the TL: https://news.ycombinator.com/item?id=7617385
your suggestion implies that the system is built rationally and to a standard. Who's to say something in that config file isnt used as a hardcoded setting somewhere in the code?
Sure, I didn't want to sound dismissive, I'm very interested in Rust semantics.
So does Airbnb...
"the ability to oppress is a necessary feature of the system (and if you don't think so, read Marx)."

That's not been in any of the Marx I've read, to my recollection, though that's nowhere near exhaustive and my recollection could certainly be flawed. Do you have something specific to point to?
It's an existential threat to Hollywood's current business models. They would sue a very big number of developers. Most of whom would fold about 30 seconds after getting the legal paperwork.

The few who remained would get crushed. Viacom's YouTube suit ran for 7 years before settlement. And Hollywood is practiced at fucking with the little people; you can see Buchwald v Paramount for an example of how they operate, and one of the rare times they lost: http://en.wikipedia.org/wiki/Buchwald_v._Paramount
Yes! Now it's time for us to generate a whole new broken infrastructure! I'm sure if we just rewrite all the Internet's crypto in Rust, everything will be great 10 years from now. No way will a radically different new transport cryptosystem grant researchers 100 new bugs to play with; after all, we'll have option types.
This comment isn't responsive to mine.
This, very much.

Normally I try to avoid getting into arguments about style and such, it's just bikeshedding. But if the OpenBSD people are going to clean up, review, audit, fix, improve and maintain this code, it makes all the sense to switch to a style they are used to and comfortable with. It also makes sense to nuke all the junk that gets in the way and which they will not and cannot test because it is not at all relevant to the platform.

Besides, the OpenSSL code is a fucking mess.
People don't watch movies in the car, so that part doesn't matter. If you're trying to compare the ease of burning to portable media, tossing an mpeg on a thumb drive is easier and basically as cheap as buying CDs were back in the day. If your only point is that the movie is playing on the screen in the office and not the screen in the living room, I think you're vastly overestimating how much people care but it's not the sort of point I think I can find data to back up, so I'm willing to agree to disagree.
But they are doing stuff like this:

1. Let's remove OPENSSL_cleanse: http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib...

2. Crap. Let's put it back again: http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib...

That plus the 'tone' of the commits makes me wary of these changes.
Well, that'd be useless to move from tabs to spaces or from n spaces to m spaces in this context, but as far as I've observed, OpenSSL codebase uses the unconventional Whitesmiths style [1][2][3], which might be a burden on the developers to navigate.

[1] http://en.wikipedia.org/wiki/Indent_style#Whitesmiths_style

[2] http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/cry...

[3] http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/src/cry...

edit: formatting
Has Facebook become too big for its boots by throttling organic reach?
I'm the tech lead for the GitHub integration, I'd be happy to answer any questions.
A site which keeps track of which of these 'Idea Sunday' ideas actually got implemented and how are they doing 1 year, 2 years, 5 years or 10 years later. Will give empirical data only how powerful are ideas.
I'd love to see a machine learning algorithm that can automatically rank headlines on their "Upworthy/clickbaity"-ness. I know there's the extension "Downworthy" that does some text-replacement, but I would really enjoy an extension that could be like a spam filter for headlines.
I contracted you over the website.
Did you actually read the second diff you linked? They did not put anything back again. They removed even more junk. It is all deletions.

I'm getting tired of all the people who complain about the humour, tone or style in the commit messages. If you have serious concerns, why not read the diffs and comment on the actual changes? This is how real problems get noticed and corrected.

But some things were in fact removed and put back again, because it turns out some ports depended on it. Sometimes you just don't notice what a few thousand other applications depend on before you remove some code.
I have exactly the same dilemma (but because I download the coverage from back home in the UK rather than suffer the terrible American coverage).

I thought about building a proxy but simple name-blocking is too broad given names like "Button", and some headlines don't contain other easily matched patterns like "grand prix". EG "Button wins thrilling battle" or "Williams duo take epic one-two"
If you google "asset management software" you should have tons to choose from.
That sounds like the job for a GreaseMonkey script :)
I had the privilege of seeing Dean Kamen speak last year about the DEKA arm. One of the things he lamented was that the FDA had to decided not to classify the arm as Class I, and as such it was getting caught up in drawn out regulation when there were people he felt it could help right now.

Video demo of the updated, 3rd-generation DEKA arm.
http://youtu.be/auetIxOaSe8
"Let’s say that you want to hire a top software engineer and are competing with equity grant offers from Facebook and Google where the value of the grant is $1mm. If you have a current valuation on your company of $10mm, then you have to offer 10% of the company to compete for that engineer. I am not saying the engineer isn’t worth it."

I totally disagree here.

I don't think you compete with Facebook on comp in this manner. Facebook stock is as good as cash. Stock at a ~A/post A company isn't. Even if you say you'll give this employee $1mil worth of stock, there is a high likelihood that stock isn't going to be worth it.

Don't go after Facebook's top engineers trying to compete with comp until you have the resources to get them, take the money ball approach and find talented people who aren't having the world thrown at them yet, and lure those people away.
Ok, fair enough. I am just making sure my objection to Google's approach is clear.

I would be OK if they guaranteed complete CRLsets from all participating CA's. Since they don't, their solution is more broken than what they are replacing.

So I acknowledge that online revocation is problematic. I just think the crlset approach is an order of magnitude worse when the crlset is a subset of revoked entries sent by the ca.
They can back the voice recognition with mechanical Turk. If the recognizer has a lower confidence than desired they just ship the sample to a human.
It's really fast at reading zip files created by Google takeout. I use it at http://theyhaveyour.info as it works perfectly with the FileReader API. For reading only though - haven't tried writing with it.
You can be selectively confrontational. Even in a dishonest way. Just watch Bill O'Reilly sometimes.
Really? So the Linux Kernel, Postgres, etc. haven't been able to scale? The only barrier that has been preventing an Open Source, volunteer run, approach from working in the physical world vs the software world has been the higher cost of entry due to materials and the machines you need to manipulate those materials. It's been pretty clear that those costs are coming down, both with 3d printing and electronics (raspberry pi, arduino, etc.) Volunteer time is just a function of how many committed people you can get together, software has proven it's most definitely possible to do this on a massive scale.
It was probably Hollywood's lawyers, and it is likely constitutional.

They can't shut somebody up for their opinions. But if you do something illegal or actionable (in this case, contributory copyright infringement), you may prefer shutting up to accepting the full legal consequences of your actions.
All: this article is on-topic for one reason: it is historically interesting.

Predictable ideological tangents are not interesting. Please keep them out of this thread and off HN altogether. If it isn't clear whether a comment counts as a predictable ideological tangent, err on the side of assuming it does.

I know it sounds arbitrary to declare what's "interesting", but (a) the term has developed a specialized meaning on Hacker News over the years, and (b) editorial judgment plays a role on this site.
Yes, I was also wondering if FSF or someone like that could take the project themselves. Let's see who comes knocking. It wouldn't be the first time FSF "facilitated piracy" by building tools like that (see GnuNet, Mediagoblin, etc), so I doubt they would be too afraid to try it.
Not sure how it happened, but s/my/many.

Also, I'm sorry guys, but most of you don't really get advanced networking concepts. Just like I don't get many advanced software architecture topics. It's a matter of specialisation.
ccccccccccccccccccccccccccccccc
What other projects do Nike have that they need a staff of computer software and hardware engineers to work on?
I really love this idea. Reddit-ish, but sort by proximity to location as well as quality score. That way, if you are in a densely commented area, you will see comments about your surrounding few meters/yards, but if you are in a less trafficked area you might see comments on your feed about something a few miles/km away, giving you a destination.

Rather than 'fencing' regions then, if it could be done to just sort proximity that way, it would be incredibly useful even while sparsely populated.
You're not going to offend the recruiter, rejection is their job.

However, you may signal to the startup that you want the job for the wrong reasons, or your risk tolerance is not high enough to do a startup. PG advises startups to look for the sort of folks who are willing to work mostly for equity, because that aligns incentives around the startup's success. If you're taking mostly salary you have little skin in the game.
Do you have anything to say regarding the actual content of the argument put forward?
If you don't mind a parenthetical point, I'd argue that Marx's specific analyses and the precise names stuck to them are too limiting at this point - or at least I'm convinced you've conflated two properties that someone pointed out a while ago would make debate considerably more productive (by virtue, I suppose, of making the "heterodox" double-qualifier idelogies suddenly more motivated) when separated - the degree to which ownership and control of the means of production are centralized; and the precise ownership described in the terms of some separate dichotomy. Your point would prescribe for the first - but "socialism" as a name I'd claim has accreted and been recast to the extent that some synthetic history in which the limited-liability company is replaced with the cooperative would be called "market socialist" by last-generation Soviet nomenklatura, and yet "social-democratic and cooperativist" by the Co-operative Party that by agreement constitutes a curiously significant amount of British Labour (and hence the use of a name.) That's neither to argue, though, that the two are a mile and a half away: you're right to say that it did once imply both, and that in past contexts (or that's my impression of Western European economic reform post-World War II) it was overbearing as a trend no matter how the actual distribution of control could be construed.

(Edited for spelling correction, the contextualization at the end, and the note about how overt signs of association affect self-appropriation of names...)
How Russian legislature just made lives more difficult for Russian bloggers
So much convenience!
Already done:

https://news.ycombinator.com/item?id=6660089

http://i.imgur.com/mmPAztu.png

I didn't get much interest so I didn't bother building it :)
I think Github doesn't have to worry here. Service providers who host content for others generally have safe harbor:

http://en.wikipedia.org/wiki/Section_230_of_the_Communicatio...

If people were uploading copyrighted material, then Github would be obliged to honor takedown notices. But here, the code's under some sort of public license, so the takedown process wouldn't apply.
I'm curious as to how this compares to a percolator. Anyone tried both?