skysight-inc/HackerNews huggingface dataset:
But there is a whole range of potential issues. Or things compiler developers can do. As any task, they should be sorted, weighted by ease of exploitation and ease of solving. What I suspect, and I'm just curious to see if I am wrong, is that developers postulate vulnerabilities that real hackers would never bother with, and miss what they really go for, such as trivial mistakes, such as forgetting bounds checking.

So, I've seen a lot of (conceptually) trivial exploits and combinations of trivial exploits, but I would love to see a real world example of someone collecting enough information from an 'bad RNG', registers, or timing, to do anything with it.
There are plenty of places in Africa (and no doubt Asia too) with shops selling factory-made goods, but no electricity.
Relevant: Will Java 8 Kill Scala?[1] (spoiler: Betteridge's law applies)

[1]http://ahmedsoliman.com/2014/03/26/will-java-8-kill-scala/
If you're using AES-NI, you're already using an intrinsic. I haven't yet met a compiler "smart" enough to recognise an AES implementation and replace it with AES-NI, and god, I hope I never do.

Yes, you probably ought to be clearing xmm* registers touched by it, and that would I hope be good enough.

The point in the article about compiled code very seldom touching xmm* so that if you don't wipe it - is doing so currently common practice? I haven't checked, but I feel like that would be something that needs checking! - it's hanging around and you might leak it, is completely valid, however.
I don't know about that. Over that time period, post 2008 crisis, many funds (PE, fixed income focused HF's and equity funds) did very high returns as most asset classes bounced back from the crisis depths. Helped along, of course, by unprecedented money printing and credit expansion by the Fed.
In addition they offer no privacy policy. That means they have complete freedom to aggregate all of the information you send to them, via your app, and sell it.
Is zomato down?
Too many connections
I keep forgetting Yunohost can do that. Is there a guide to setting up email services?
Its facing issues. Works sometimes, says "Too many connections" at other times.
Currently, vectors are the only real data structures; they're naively persistent: operations like rest and cons create a fresh copy (I haven't implemented COW yet). I'm not quite sure how to implement it for `setq` though (a feature not present in Clojure, but something that's necessary for building an editor like Emacs): when a variable is set to a new value, where is the reference to the old variable, for gc and access?
This makes no sense. Most kids won't inherit millions of dollars with an incredible network of influentials.

If Gates pushed what was best for his kids to others we would have an uproar about the fact that most kids can't go from interest to interest with no concern for income at all.
You could set up your MUA today so that anyone you've already emailed with gets put in a priority folder. No need to mess with end to end encryption just for that functionality.

Theoretically, any spammer could research you enough to send to mail purporting to be from your friends, but realistically no one would bother.
Yes but the copy on the site doesnt explain this, why should anyone sign up for vagueries?

Additionally, most other analytics tools do this, but this one seems to have a similar price and limited functionality.

Not saying it wont work, just that the messaging needs a lot of improvement.
asfq1
AirSign.app: modify, resign and share iOS Apps for testing
If you want to start a startup, go work for someone else
A real hacker would tell you that all these books are really not needed. All you need to know is in-and-out of any one os( say windows), and good understanding of any one hardware architechture (say x86). Practical reverse engineering\hacking is then about getting your hands dirty by doing things using tools like IDA. What you really need is a very strong intuition and understanding of software upside-down (from hardware instructions to source code and vice versa). There is a reason why practical hacking\reverse engineering is an ART.
Are current GPUs suitable subsystems for running properly isolated cryptographic algorithms? If not, why not? If yes, perhaps a well-audited open source library would be possible.
its intermittent.
9-step Cheat Sheet to Become a Great Public Speaker
Is the compiler still allowed to optimize away the zeroing in this case?

With 'volatile', generally not, modulo bugs. Without volatile, it would never return an error.
Oh, hi Wordpress :)
This is not Reddit. Please read the guidelines at https://news.ycombinator.com/newsguidelines.html
You still are not guaranteed to clear the buffer like that.

for (int i=0; i<len; i++){
sensitiveBuffer[i]=random();
}
int sum=0;
for (int i=0; i<len; i++){
sum+=sensitiveBuffer[i];
}
volitileVar=sum;

Using loop fusion, the compiler can optimize this to:
int sum=0;
for (int i=0; i<len; i++){
sensitiveBuffer[i]=random();
sum+=sensitiveBuffer[i];
}
volitileVar=sum;

Which it can then optimize to:
int sum=0;
for (int i=0; i<len; i++){
sum+=random();
}
volitileVar=sum;

In fact, as the article points out, the compiler can legally transform:

reallyZeroBuffer(sensitiveBuffer);

into

pointlesslyCopy(sensitiveBuffer);
reallyZeroBuffer(sensitiveBuffer);
Depends if the question is targeted to startups using the JVM or the classical bureaucratic enterprise.
"Use BIOS ram hacks to make a SSH server out of any INT 10 13h app (MS-DOS is one of those)"
would like to know how this is achieved.
I wasn't sure what you were offering, so I clicked on "How it Works" where I learned how to signup by entering an email and password. Thanks for this useful information, I'm not sure how I managed up until now without knowing how to signup to websites :-)

Joke apart, I do think that it's a good idea but you really need to make it clearer. The first page is very vague: A dashboard that allows you to see what's going on in your operation? Are there any other types of dashboards?

You need to explain right from the beginning that you're product will help with sending emails to increase retention.
So you don't use type classes in Haskell?

Neither touch F# or OCaml.

Nor CLOS in Lisps.
How does that require writing the random data to RAM, apart from the volatile variable itself?
> In the snippet below, the compiler is allowed to eliminate all code after “leave secrets in array c”

gcc 4.4.5 doesn't though (-O3), it still clears the stack once and performs the comparison.

I believe these optimizations can be defeated by declaring a global

volatile char fill = 0;

and using that instead of 0 in memset().
And even those have modern standards.

Object Cobol anyone?
You could do that in the comfort of your own home, with a decent Internet connection (for example with https://zmap.io/)
Ajay Bhargava, TCS Shares the Big Data Mantra: Harness Data and Harvest Value
Not all crawler have advertising giants with billions of dollars worth of resources behind them. Some are just curl or similar things.

If you want to participate in low-level crawling like for microformats/indieweb or similar things there is an advantage for static pages: you participate in a more democratic web not in one which just works for the big stacks.
Well, there was StrongTalk as well.
> I was fortunate in winding up at Caltech, which had a policy of open book / open note exams.

I don't remember that as being policy. I definitely had several closed book exams, including one memorable pass/fail final first year that I failed by one question that I could have easily answered if I could have just looked for 5 seconds in the book. It was tempting...I was taking the exam in my room, with the door closed, and the book was sitting closed within arms reach on my desk from my pre-test study session. I knew exactly where to turn to in the book to get what I needed. But taking a peek would violate the Caltech honor code, so it was or course out of the question.

The only exam policy I remember was that exams were required to be take home exams rather than in-class exams. A professor needed to get special permission if he wanted to give an in-class exam. I never had an in-class exam at Caltech.
can anyone point to other articles from indie iOS/android developers where they share figures and learnings?
Unlikely, Clojure is very much its own thing, won't draw those that are drawn to Scala (rich type system, (G)ADTs, performance, etc.). That branch of potential adoption is minisicule anyway (even compared to Scala which relative to Java is itself tiny).

So, the elephant in the room is indeed Java 8. Will Scala at long last be killed? Perhaps, but highly unlikely, Scala lives and dies on its ecosystem (Akka, Play, Spark, Spire, Spray, etc.) which are seeing ever increasing enterprise adoption.

If anything Java 8 and the JVM improvements made and coming will aid all languages on the JVM that are different enough from Java 8+, which Scala, Ceylon, and of course, Clojure, are. The only JVM language made vulnerable by Java 8 is, IMO, Kotlin.
Looks awesome, could do with a write up though. Also there must be a 'nicer' way to do this[1] in Go, rather than a huge bunch of if statements?

1. https://github.com/benjojo/dos_ssh/blob/master/data.go
It strikes me as ironic that he would pick Twitter to convey >140 char essays.
Hello Tommaso,
I developed something VERY similar to that algorithm back in 2007 (C++, software rendering), and then again in 2012 (in Java for Android, with GLES).

I got some of your issues fixed back then. Ravines, for instance. You might want to take a look:

(3-clause BSD): https://github.com/TheFakeMontyOnTheRun/derelict/blob/master...

(GPLv2): https://garage.maemo.org/plugins/scmsvn/viewcvs.php/angstron...

Don't hesitate to get into touch. I will gladly explain anything.

I'm not looking for money. I'm just trying to help. I always felt bad for this algorithm to just gather dust. That post of you made my day.
But your smartphone is something you already have. If it takes ten seconds then you already paid for those ten seconds when you brought it.

Of course spammers can buy their services but when the price for normal sending is effectively free for normal users you can jack up the price for spammers to make it too expensive for them.

A nice benefit is that it forces sites to use something other than email, such as RSS, since they can't afford to send newsletters anymore.
General availability of the Tilaa API
“Thinking less of yourself” is mathematically wrong
I suppose the CA's didn't jump on issuing SHA2 certs the same day as the as the Baseline update or the MS announcement, but they don't seem to be standing still.

GlobalSign, the first one on your list for example, has limited the validity on new SHA1 certs to 3 years and will reduce that to 2 years and 1 year as the MS deadline approaches.
https://blog.globalsignblog.com/blog/everything-you-need-to-...

Don't know if GoDaddy has limited the validity periods, but they do list the deadlines and suggest re-keying your cert:
https://support.godaddy.com/help/article/4818/information-ab...

Wondering how many of those certs from GlobalSign, GoDaddy, GeoTrust, etc. are 4 & 5 year certs purchased prior to any announcement? As you noted CA's like to push multi-year certs.

While you can usually reissue/re-key your cert free of charge with CA's, a lot of companies are probably hesitant to make sudden moves to SHA2 when there are compatibility concerns. Many on legacy systems like Server 2003 cannot update to SHA2. As I mentioned in another comment the hotfixes only bring Server 2003 SHA2 support up to the same level as XP SP3. (Only compatible as a client, not as a server).

Also Microsoft's fastest approaching SHA2 deadline is January 2016 for CodeSigning yet Windows Vista & 7 don't support SHA2 signatures on kernel drivers. Not sure if that's been patched yet, but it would seem Microsoft isn't fully prepared to support their own policies either at the time of their own announcement.
The developers of Camera+ have been releasing sales figures throughout the years that Camera+ has been available. Of course, they make millions from the app so it paints a slightly different picture than the typical "indie" app sales numbers.

Camera+ first month: http://taptaptap.com/blog/cameraplus-first-month-sales/

Camera+ hits $2 million: http://taptaptap.com/blog/cameraplus-hits-2-million-sales/

Camera+ hits $6 million: http://taptaptap.com/blog/cameraplus-reaches-6-million-sales...

Some things to note about Camera+ sales figures and how popular their app has been: 1) they run the extremely popular MacHeist promotion so they already have an established audience and email distribution list of over 100k people, 2) they were well known in the iOS community before releasing Camera+ so they had a base of people to spread the word, 3) Camera+, when released, was an amazing and different camera app and the market loved it.
Show HN: A free invoice generator
I built this[1] because I couldn't find any other such tools that met all of the following criteria:

* Use SSL
* Save settings through localStorage
* Allow PDF export w/o any watermarks
* The exported invoice must look identical to the preview

1: https://www.free-invoice-generator.com
Right. Most projects offer a little info in the readme. Looks like it's just a few hundred lines of go, with zero documentation.
Streak (YC S11) Is Hiring Front End Engineers
Streak.com (YC S11) is hiring full time frontend engineers. We’re a small and nimble company working on email for businesses.

At Streak, you’ll be able to:

- work on incredibly challenging front end infrastructure. We’re a sophisticated web app built on top of the most sophisticated web app out there - Gmail. We’re also planning on exposing our Gmail infrastructure to 3rd parties so you can help build a platform to build apps on top of Gmail.

- work on a product that people use everyday for 28% of their day.

Obviously:

- Great compensation and real ownership (both equity and over the product)

- We’ll make your life easier. Our benefits package is amazing

- We’re well funded by great silicon valley investors and are profitable

Our requirements:

- you love working hard, not just for financial rewards, but for the opportunity to grow personally

- you are intellectually curious

- you live (or want to move) to SF and are authorized to work here

We’d love to hear from you at frontend@streak.com, please send us samples of anything you’ve built.
Doesn't targeting LLVM get you this kind of flexibility "for free"?
My company basically does this to some extent now. Group hangouts basically fills in for conferences and we all get rMBP issued so we have web cams. Since it's all 1:1:1:1, you can see people really well in the conference, facial expressions, etc.

Run of the mill broadband is "good enough" for most of this.
Honestly i 'm just guessing on Fortran and COBOL. I wasn't there when they lost prominence. I just know that no other languages actually lost significant amounts of popularity for not changing (java? Its maybe less popular but calling it dead is not even wrong).
Smalltalk lost the spot in the industry thanks to Java, sadly I doubt it will hardly get a second chance.

Back in the mid-90's, before Java was released to the world, I was using VisualWorks for an university project.

IBM was a big enterprise player with Visual Age for Smalltalk.

A small startup (Animorphic) was making Smalltalk faster (StrongTalk).

There were, of course, other companies searching their piece of the pie.

When Sun started pushing Java to the world, many in the Smalltalk world shifted direction.

Visual Age for Smalltalk architecture became the foundation of Eclipse.

Sun eventually bought Animorphic and Hotspot was born out of StrongTalk VM ashes.

Slowly, other Smalltalk players joined the party.
6 Principles for Building a Winning Business Culture
Check the Greenify app, it could help you to achieve a such setup.
https://play.google.com/store/apps/details?id=com.oasisfeng....
yeah, ok... that makes more sense ;)

BTW, thank you for your contribution to pfSense - it's the best darned firewall I can find.
What is the reason for using product of all primitive types for boxing instead of tagged union?
That's very much the point. The FBI can make an argument that they weren't trying to gain access (since a real attempt to gain access would have looked different from "entering miscellaneous strings"). They were trying to see what the system did when authorization attempts failed. As far as I know, there's no law against that. It's similar to going through a suspect's trash.
Yup. I wanted to write an onion headline "Yahoo in talks with Taco Bell to purchase 10 billion tacos with alibaba windfall"
As I understand from looking at the code, there is a VNC server and a GDB server "running" on the machine already. These are probably provided by a virtual machine. VMware and Bochs both seem to support GDB-like debugging to some extent, and remote access through the VNC protocol.

This package simply queries the screen via GDB, sends it off to SSH connections, and sends any keystrokes via VNC to the DOS machine. From the title I thought the SSH server runs directly on the DOS box, but as I understand, no Go code actually runs on the DOS machine.
That's really cool. From the way the cursor flashes in the video, it seems to refresh the screen pretty often?
Does it do that constantly, 30/60 frames per second or only if something changes?
Yes, with table driven logic

Not a lot prettier, though...
New in WordPress 4.0 with features and screenshots – DesignRive
I'll second Racket but for somewhat different reasons.

1. Like Python, the Racket community is oriented toward teaching people to learn Racket. This is something it inherits directly from Scheme's creation in part as a teaching language and four decades of use as one. [This is in contrast to Common Lisp, which tends to be more oriented toward practical professional programming].

This means that the Racket community is attentive to the onboarding process and sensitive to the fact that people come to it with widely varying levels of technical sophistication and familiarity with programming.

2. The core of the Racket contributors are in academia and this provides both stability to the core language's roadmap [e.g. Felleisen has been working on Racket and it's predecessor for several decades], and contributions from the edges of computer science to both Racket's libraries and core [i.e. Felleisen's graduate students have been working on Racket and its predecessor for several decades].

This means that Racket as an ecosystem is both big, and has canonical libraries for a lot of the non-core functions a programmer might wish to use.

3. However, one of the Downsides of Racket is a lack of IDE options. Dr. Racket doesn't really compare to big iron grade IDE's like Eclipse, IntelliJ, or Visual Studio. It's more like a top of the line Huffy than something you'd choose for a double century.

That's not to say that Emacs isn't an option, or that a more traditional Lisp development approach aren't alternatives - for the former see Geiser [1], for the latter see the Systems Programming with Racket Tutorial [2].

4. The other alternatives are Clojure and Common Lisp. Both communities are targeted more at the professional programmer than at onboarding a population with diverse levels of technical expertise and objectives. You sort of have to dive into the middle.

Clojure's community being newer has much more of a "web 2.0" vibe. Being focused on leveraging popular virtual machines [JVM, javascript, CLR] and having a single celebrity spokesmodel, there is also more of a tendency of the community to get behind tools, libraries and methods as canonical and to make these available in a more contemporary fashion.

On the other hand, Common Lisp has decades of really smart saavy developers creating efficient tooling and well written documentation for it. There's a lot out there. The community is just more diverse and the resources often require access through "web 1.0" style interfaces. The community shows its heritage in the "pre-internet".

One of the great positives is that the Common Lisp community has a greater willingness to go deeply intellectual on programming and general. It doesn't have marketing brochures.

[1]: http://www.nongnu.org/geiser/

[2]: http://docs.racket-lang.org/more/index.html
Isn't the point of open source for people to contribute and improve the projects?

Edit: Well isn't it?
The enterprise world isn't exactly known for adopting new languages, JVM or not JVM.

But you could provide some kind of source if you disagree, all the statistics I've seen have had Java and JVM languages in a steady downward slope for the past five years or so.
Show HN: Ecommerce platform with global shipping, Bitcoin and Paypal payments
Like this maybe? http://en.wikipedia.org/wiki/Virtual_DOS_machine#NTVDM
"Right now, there are about 1,800 survivors of the current West African outbreak, all of whom are now immune, of course. But there may be many thousands more."

Well, that's conjecture, oddly enough, reinfecting people with a deadly disease has various ethical issues - so there aren't any experiments to look at.

When it was tested with primates [1] they all survived after a 10 week period but 2 out of 6 died after 13 week period. How this works for humans god knows but 'all of whom are now immune' I wouldn't be so confident.

[1] http://www.nature.com/srep/2013/131128/srep03365/full/srep03...
From /r/darknetmarkets (so grain of salt is needed):

> yeah it was about 6-9 months before it shut down if I remember correctly, it was pretty highly upvoted and a lot of chatter about it on the SR forums. though I think there were at least a few bugs that they had to shut down for once they realized that their asses were on the line.

http://www.reddit.com/r/DarkNetMarkets/comments/2flnlp/fbi_s...

So yeah, apparently this was an actual bug.
Thank you for all your contributions, Paul, you have been instrumental in helping me improve my understanding of various programming language and functional concepts.

I'll be keeping a close eye on what you decide to do next, I have no doubt it will be extremely interesting.
"a number civil rights in Australia automatically disappear if you were in the midst of committing a crime while trying to claim them."

That doesn't make sense to me. You haven't "committed a crime" until you've been convicted.

You seem to be saying that you lose the rights merely by being suspected of a crime.

If that is the case, those rights don't actually exist in the first place.

In the US, they have successfully prosecuted people for "fiddling" just like the FBI did here.
I think reputations are part of it but there are other aspects to.

I switched to gmail because my mail with every other provider and client was choked with phishing messages from major banks. So much work has been done on preventing origin spoofing in 2014 that accepting phony mail from chase.com is a sign of gross incompetence.
I suggest you do.

If your account is less than a year old, please don't submit comments saying that HN is turning into Reddit. (It's a common semi-noob illusion.)
The problem is not setting up an email server; the problem is in ensuring you email is delivered/visible. I set up an email server vps with my domain and domain keys etc but my test emails to my family ,who use Yahaoo and Gmail, would not get delivered. I gave up !
the problem is, after they give you your margin, or cut, or discount, as 'distributor, you buy just 1 item. for yourself.

there are vendors that actually don't care, and anyone can sign up as a reseller. but apparently you asked a few who do.
So this server won't actually run hosted on an MSDOS int 10 13h OS, but it will screenscrape the BIOS video memory area from such a machine across an already running remote GDB session, it looks like. It also requires an already running remote VNC server to inject keypresses.