skysight-inc/HackerNews huggingface dataset:
^^ Exhibit A: One of the firms you'd want to try your hand at working for first :)

They might also send / you'd want to read:

- Gray Hat Python (debugging and fuzzing with Python)

- The Tangled Web (web browser security and insecurity)

- The Art of Software Security Assessment - the bible, which you really want to read as it's a foundational text. Very dense, but you'll come out of it knowing how to attack memory very well.
Is interface{} similar to type erasure on JVM?
Another look at my programming language arsenal
The rule says "unless it is misleading or linkbait", so in the case of linkbait it's not only legit to change the title, it's requested.

We've attempted to replace the title of this article with a more neutral one.

https://news.ycombinator.com/newsguidelines.html
Is there a similar guide available for ARM? x86 seems pretty messy.
Help me understand your objection with the proof. Are you saying that the set of values c2, c1, c0, a, b can take in OpenSSL is a subset of the values that they can take in the SMT formulation? Why does this invalidate the proof, though?

Edit: In response to this edit of yours:

> The other major hurdles is extracting the code in a way that can be usefully presented to solvers without a lot of potential for human error or extreme effort (e.g. OpenSSL is 400k lines of code, good luck with making progress if you're hand rewriting things for the prover). Frama-C (http://frama-c.com/) can help with this and I've used it to good effect on very small pieces of code.

Not even the most hardcore formal verification supporter will suggest a complete verification suite based on automated verification tools. Generally, you pick a subset of the code that is critical, poorly understood and is amenable to formal verification and expend some effort in proving properties about it. There's obviously a lot of subjective judgement here both in choosing the subset of the code you want to look as well what properties you attempt to prove. But that's what we get paid for, right?
I don't think that it's circular definition. Definition talks about the one you love, in other words:

love(x, y) = x has the active concern for the life and the growth of y

"Where this active concern is lacking, there is no love" only says that "if x has no active concern about y, love is zero".
Ask HN: Is there a way to write code using handwriting recognition
Thinking of writing code on pen tablet, but I am not sure if that will work with eclipse. Anyone has tried this? Any suggestions? How was your experience doing this?
This is no longer true for apps created after last years F8 conference (4/30/2014, Graph API v2.0,) and I believe the deprecation schedule ends in April.. Older apps will no longer get this by default.
Tips to keep you safe and secure online
Too bad OP didn't include one of the major specific criticisms, instead of unconvincingly talking about the evidence pyramid: healthy-user bias.

So, the study looked at whole-grain eating and a health outcome, and the study found lower incidence of the health outcome? Who could have predicted that? (Well, everyone. It even used the Nurses’ Health Study for data!) That is almost as bad as the soda study a while back: https://news.ycombinator.com/item?id=8490522
Could gravitons or tachyons, if they existed, come out of a black hole?
OpenSSL patches eight new vulnerabilities
`hstore` is good if you know for sure you'll never have nesting (because the values have to be primitive types). Otherwise, JSON is probably the safer, more reliable bet, though it's slightly slower.
That the average person who pursues a job is not very successful economically does not mean that the job is not worth pursuing for someone who is thoughtful and talented. As noted above, if the median child support is only $6000 tax-free dollars per year that suggests that high-income potential fathers are an underutilized resource.

http://www.bls.gov/ooh/computer-and-information-technology/c... shows that the median computer programmer gets paid $75,000 per year. That doesn't stop thoughtful and talented programmers from earning a lot more (though collusion by employers, e.g., Apple, has interfered with what would have been a market).
Can DNA Nanobots Successfully Treat Cancer Patients? First Human Trial Soon
> Especially when we're not building traditional "web pages", but rather full web-apps - requiring fairly complex UI and business logic.

I think that is the main point. For many traditional web pages, there are not many reasons to really require a lot of JS or so.
>> "releasing the documents would hamper the department's ability to conduct operations and endanger the lives of New Yorkers."

Ha, am i the only one that parsed that as "releasing the documents would hamper the department's ability to {conduct operations, endanger the lives of New Yorkers}"?
The Future of Medicine Is in Your Smartphone
It's great that you're ready to take the leap in to making profitable side projects. Typically most side-projects fall in to two categories:

1. They never launch

2. They never make any money

If you can avoid these two pitfalls, you will likely achieve one or more of a) earning; b) learning; c) increasing your 'luck surface area'. So, it's a good opportunity if you can do it. There are plenty of reasons why you wouldn't have launched including:

- you kept your idea secret

- you tried to do too much

- you underestimated the areas that you're not skilled at

- you assumed that if you built it they would come

- More here: http://www.startupclarity.com/blog/launch-first-product-what...

The reasons for not making any money, or rather not making enough money that you wish to pursue it are multitudinous but include:

- you didn't choose a profitable product idea

- you underestimated the slow ramp of death: http://businessofsoftware.org/2013/02/gail-goodman-constant-...

- you charged too little

- you didn't solve a problem for people who were willing to pay you

- More here: http://www.startupclarity.com/blog/find-profitable-product-i...

I hope that helps and Good Luck!
I am still recovering from a labyrinthitis I had more than a year ago. I was indeed surprised by the lack of research in the ear field and how much doctors don't know what is going on and how to fix it. Happy to read that some start-ups are filling this void !
Good luck to everyone who has these kind of issues, it's not a fun ride.

ps: for moral support I suggest to check out theses websites:
http://vestibular.org/
http://www.dizzytimes.com
edit: just to be clear, I'm responding to this statement:

> Formal verification does take more time over empirical testing methods

I don't even know if that is true, at least, I'm unconvinced about it being true in hardware verification. The amount of manpower and effort companies like Intel and AMD put into simulation-based verification is insane and a lot of that could be replaced (and has in some case been replaced) by a well-designed formal assertion suite.

The real bottleneck is people. It's a lot easier to find competent engineers who can hack around with tests and simulation suites than it is to find people who can hack around with abstractions for scalability in a model checker.
I generally prefer PDFs for archiving. HTML is good for following hyperlinks, though.
Being that fundamentalist religions are at war with contemporary society, I would disagree.
The function in OpenSSL would be incorrect if it were asked to work on the full range of possible inputs. E.g. in my trivial example if the accumulator (C_n) at the maximum value, it would overflow for any non-zero input, and wrap around and give an incorrect result.

OpenSSL doesn't demand that of the function-- the ranges of the inputs are limited-- but nothing in the z3py example on the page appears to express that precondition. If OpenSSL's demands were different the code would be incorrect, but it passes the verification.

> in proving properties about it

In proving something about something. :) If the process involves hand transcribing the code ... well. I don't say to argue that this isn't interesting or useful.

I use formal methods some in my own development and would like to use them more heavily. But I've found that the state of the tools right now is exceptionally limited: A lot of effort, to prove very narrow properties-- ones which might be misleading about the correctness of the software, on models which may not well match the actual software, and which gives assurance that rots a bit over time because it's not sufficiently automatic.

In spite of these things, if we don't apply formal tools I believe we'll never be able to escape the orgy of failure that we have with software today. But it's best to go in with eyes wide open. :)
RemixOS is based on Android 4.4.2, but it is proprietary. Not sure how I feel about that.

Why not make the OS open source?
I've saw this yesterday, pretty happy about it, but then.. see that the compiler was coded in haskell..

This make it pretty "unportable" because its the same dependency with the Java VM, so how can i distribute code with this library, with a dependency like that, asking people to download the whole GHC ?!

Unfortunately for libraries that should be embedded in third-party code, the reality beyond C/C++ is pretty harsh.. for full applications the reality is different.. but for embedded libraries.. despite the fact that i've liked the solution for something im doing, i had to pass because of this small detail.. and im too busy to write a parser in C++ to make this more portable in source code form.. so i had to get back to protobuf :/
Exactly. I was never meant to totally replace NTP but to cover only the most common usage of it.
POP and STOP: #SAVETHEBEER – Opener and Sealer
Same goes for NSA's "protection" through mass surveillance.

"These programs work" - they said. Except for when they were actually audited and the auditors found no evidence of the programs "working".

But whether they work or fail, they always seem to ask for more surveillance powers and bigger budgets. Mike Masnick also had a good article on this:

https://www.techdirt.com/articles/20150109/06555029648/uk-in...

I think it's more a problem of following the leads they do have. 9/11 attackers were known to be planning an attack, the Charlie attackers were also known (not through their surveillance, but from a tip from another country). But they didn't follow through.
In principle I agree with you, but be aware there is no country where speech is fully protected. You can't go into a crowded theater in the USA and yell "fire!", for example.
This is a good vulnerability to be aware of, but the OP is probably wrong about "server maintains the authentication cookie" -- what's probably going on is that the servers simply don't maintain state at all, the cookie alone has the state, so replaying the cookie will always work.

Just about any Rails app using the default cookie-stored sessions will behave the same. Not because the server is "maintaining the authentication cookie", but precisely because the server is maintaining no state at all, it's all in the cookie (which in the latest versions of Rails is by default encrypted and signed, to prevent snooping or tampering -- but that doesn't prevent replay).

I think most people set cookies https only, figure they can't therefore be sniffed, and don't worry about it.

If you wanted to deal with it, still without maintaining session state on the server, I guess the best thing to do would be to put a timestamp in the cookie, and refuse to honor 'old' cookies? That still wouldn't make the cookie invalid as soon as someone pressed 'logout', and would be tricky with intended 'long lived stay logged in' cookies.

Eliminating server session state can make things (especially scaling) a lot simpler. I think it's probably good enough to https-only your cookies and call it a day. No?
What is Google doing to your brain?
Is there no way to check out pricing before signing up?
First thing I thought of was photos, and they are all on the computer. Which is backed up, but onsite.
1 - build an online portfolio of work (if you don't have one do personal/free projects to build it.

2 - go on elance/odesk to find some paying clients (pay is low, but easy to find). You can also use this to try different things and discover what kind of work you enjoy best. you can also call some technology consulting firms - they are always looking for talent.

3 - specialize in that area. tailor your website/blog to talk exclusively about that technology. between the inbound from your site and client base from consultant you'll easily be able to build an overwhelming referral stream.
Did I miss the message they were trying to convey?

Nope, you had it in your first sentience, the article doesn't really say anything at all. I've recently started considering TC's coverage "tech-adjacent", a poorly-formed idea that their target audience is people who work in or with tech-heavy fields, but would never be called on to design or implement systems themselves. TC can talk tech-adjacent stuff to techies, or tech to tech-adjacent, but talking tech to techies elicits a uncanny vally-ish reaction.

FWIW, I think what the article inadvertently speaks to is that the apprehensiveness to strongly centralized systems I've watched grow for at least a decade is starting to resonate with even more people.
Or, you know, they just didn't want to publish racist caricatures under the guise of satire.
"Unemployment rate for Physics PhDs is just under 10%" -- that sounds pretty bad if you assume that someone with a physics PhD is smarter than average and has more years of education than average.
As an American living in Oman, I can vouch for thousands of tourists visiting each year without running into these issues. I personally, have never experienced any sort of problems, and Oman is a MUCH nicer place to live than other parts of the Middle East.
That the major news networks in the US were also cowardly does not make it right.
(Swedish. Politically speaking right-wing in that spectrum. In the US political spectrum; probably centrist.)

If I were a NYC citizen, I'd approve of a police authority that was innovative enough to bring these things onto the streets. NYC is a terrorism magnet, as has been shown.
Ultimate Guide for Scraping JavaScript Rendered Web Pages
Did somebody take him to the cleaners once? He's had all his recent children by surrogate and there is rarely any mention of his wife (I believe he has one) - it seems to be a neurosis with him.
The Magic SysRq key
If you need a crawler for this, let me know. :)
Probably this.

Just because most people won't go on a shooting rampage over them doesn't mean the images aren't offensive to some people. No point throwing fuel on the fire.
This seems to imply that servers are saving a copy of the cookie on their end. But in reality it's more like dropping a cookie with enough information in it to uniquely identify the user. It then encrypts and signs the cookie. If the server can decrypt the cookie and the signature is valid it knows that this is a valid auth cookie.
the point is that offending someone with drawings is not the same as killing (or jailing!) people who you disagree with.

That's the final motivation. It's also called free speech.

Anyone can be offended by anything. As an atheist I'm offended so many people choose to believe in a man-made fantasy. But hey, I'm not going to kill them, jail them,or what not. I expect the same in return. You can certainly disagree or make cartoons about atheists tho. I might find them funny or be offended, who cares.
>Typically PHP stuff where the paid developers hyperoptimise for MySQL

That's quite true. My experience with MySQL comes from working with company intranet installations that didn't see that much traffic and some web apps, all with a high read-to-write request ratio. They all ran off a single DB server (some hardware, some VPS), so my administrative work was limited to automating fairly straightforward tasks with things like Ansible. I'm curious to hear an example of the kinds of problems you've run into with MySQL, since I assume you deal with more complex and larger-scale deployments. (And I'm looking for anecdotes to help persuade customers and developers alike to give Postgres a try.)
"I cannot even express to you how much I hated Barney," Martin says.

A deeper pit of hell is difficult to conceive.
+1. My first thought was exactly that. I have an idea, but no time to put work into it yet. Why would have give it to you if it is a good idea.
SpaceX Rocket Makes Crash Landing on a Drone Barge
I wish the article would have hit on a key distinction: there is a difference between technically decentralized and economically decentralized. The first is about network topology. The second is about who owns and benefits economically.
> Did I miss the message they were trying to convey?

No, they didn't do a good job of explaining it. 'We' basically failed at building easy-to-use decentralized 'services' and those who don't think it's a big deal to do so built a bunch of centralized services that were easy-to-use and also made their investors rich. Users don't understand all the ramifications of using a centralized service, so they ended up using what was easier, instead of what was better.

Further, the reasons to move away from a centralized service are difficult for most people to comprehend, so there's not a way for clear intent to emerge, other than a bunch of us rattling the cage now and again trying to get others to pay attention.
Free expression, provided it does not infringe on the next guy's freedom, is fundamental to the survival of a democratic society.

Otherwise, we might just as well move to Saudi Arabia, or back to centuries long past.
Of course they are offensive to some people. That's the point. Offend and ridicule views which are ridiculous.
Rilke's Letters to a Young Poet, especially letter #7, has similar sentiments.

"It is also good to love: because love is difficult. For one human being to love another human being: that is perhaps the most difficult task that has been entrusted to us, the ultimate task, the final test and proof, the work for which all other work is merely preparation. That is why young people, who are beginners in everything, are not yet capable of love: it is something they must learn. With their whole being, with all their forces, gathered around their solitary, anxious, upward-beating heart, they must learn to love. [...]"

http://www.carrothers.com/rilke7.htm
Is it? To start that JIT process, you need to have a class in your code that the compiler for the .NET version generated. Disk space is cheap nowadays, even on mobile, so I do not see a big disadvantage of generating the deserialization code at the same time the source code for the class gets generated (and if you things that way, you lose get one-time delay, and you don't need the code that generates those serializers in your application)

What a I overlooking? What information is know at runtime that isn't already available at build time? (And no, "the exact CPU/memory/etc. the code runs on is not a valid answer. This is C# code, so there always is a runtime that handles that stuff)
Words and other speech are not a reasonable justification for extremism and violence. They might be claimed as one, but they are not.

It's also problematic to worry about the consequences of speech like that. What happens when people start warning you that publishing the truth will drive them to extremism? Of course publishers should consider how their speech will impact people, but they should not refrain from publishing just because they see potential for a negative impact.
LastPass released the same feature basically

Check it out:

https://blog.lastpass.com/2014/12/introducing-auto-password-...
The Charlie X Method: How to overwhelm the extremists
If you configure your indexes properly, you get replication in ES for free: http://www.elasticsearch.org/guide/en/elasticsearch/guide/cu...
Ask HN: Front-End Web framework/library to use today
Lately many people ask me what Front end framework they should use.

I'm a big fan of Backbone and was able to build large (isomorphic) web apps with a few team members. Backbone in in decline of popularity, so I'm not sure it's a good choice to start with today.

AngularJS is the most popular, but I never liked the fact it places JavaScript code inside the HTML (seems like the 90's all over again).

What is your go to framework/library to start with today?
Ampersand.js
No Framework (plain JavaScript)
Internal Framework
boo. hiss. (and actually a clever reply tottenhm)
I like this solution to the problem: The Charlie X method http://www.zerohedge.com/news/2015-01-09/charlie-x-solution
to be honest I wasn't even thinking as specifically as these suggestions - not that any clear solutions occur to me either. but they should, at the very least, recognize that there is a problem that needs to be addressed. I'd like to think there's a less fatalist & more morally empowered approach available besides "forget it, jake, it's anonymous". side note, it's good to see someone here considering the needs of poorer users
gzip:
tar -cz /home/me/source/directory | ssh target tar -xz --directory /home/you/target/directory

xz:
tar -cJ /home/me/source/directory | ssh target tar -xJ --directory /home/you/target/directory

ssh -C won't be as good. in particular with a recent xz that's threaded it will probably be faster than OP's with a good CPU
http://www.xorpd.net/pages/xchg_rax/snip_1e.html

This is a classic.

Also related: http://www.df.lth.se/~john_e/gems.html
I love the http://nextdraft.com/ daily email. Short paragraph summaries of the day's news, funny, and with links if you want to read more.
Ask HN: Are there any startups in SF that don't have an open plan office?
arcfour is arguably close enough to not encrypting these days ;)
Ask HN: Where do you get your news?
While home on winter break, my parents asked me what I read to stay tuned to news and current events. I responded "Hacker News," but it got me thinking that I should be expanding my horizons. How and from where do people consume news? Do you use news aggregators, RSS feeds/readers, or just have a handful of sites you check back to?
Let's accept your assumption that colleges teach things that are of value in some non-financial sense. Colleges make society better or make people happier. Then we should expect to see an improvement in a King of Bhutan-style Gross National Happiness rather than a reduction of inequality or an increase in GDP.

If Americans aren't, on average, happier than they used to be (adjusted for income), then the conclusion should be "there was no return on the investment in broadening the number of people attending college"
Does anyone else get the impression that though the japanese may be obsessed with robots they are way behind the rest of the world in terms of technology? For example compare Hondas asimo to Boston Dynamics' atlas.
This definition of love as a binary relation is interesting. Fromm, in a way, goes beyond it. From The Art of Loving:

If a person loves only one other person and is indifferent to the rest of his fellow men, his love is not love but a symbiotic attachment, or an enlarged egotism. Yet most people believe that love is constituted by the object, not by the faculty. In fact, they even believe that it is proof of the intensity of their love when they do not love anybody except the "loved" person. This is the same fallacy which I have already mentioned above. Because one does not see that love is an activity, a power of the soul, one believes that all that is necessary to find is the right object - and that everything goes by itself afterward. This attitude can be compared to that of the man who wants to paint but who, instead of learning the art, claims that he just has to wait for the right object - and that he will paint beautifully when he finds it. If I truly love one person I love all persons, I love the world, I love life. If I can say to somebody else, "I love you," I must be able to say, "I love in you everybody, I love through you the world, I love in you also myself."
bigot not racist.
Your Islamophobia is showing.