skysight-inc/HackerNews huggingface dataset:
I don't know that anyone claimed that a bug similar or analogous to heartbleed couldn't be reproduced in Rust. If they did, that was certainly an overstatement. I think more concretely people claimed that unreachable code yields a warning in Rust, which is absolutely true, but certainly not equivalent to saying something like a heartbleed bug would not happen.

In general, Rust is fairly aggressive about linting for "small" details like unused variables, unreachable code, names that don't conform to expected conventions, unnecessary `mut` annotations, and so forth. I've found that these lints are surprisingly effective at catching bugs.

In particular, the lints about unused variables and unreachable code regularly catch bugs for me. These are invariably simple oversights ("just plain forgot to write the code I meant to write which would have used that variable"), but they would have caused devious problems that would have been quite a pain to track down.

I've also found that detailed use of types is similarly a great way to ensure that bugs like heartbleed are less common. Basically making sure that your types match as precisely as possible the shape of your data -- with no extra cases or weird hacks -- will help steer your code in the right direction. This is a technique you can apply in any language, but good, lightweight support for algebraic data types really makes it easier to do.
What a POS that kid is. He has the skills and ability to create a legitimate company, but decides to take the easy path (at least in the short term).
Ah, remote implementation of traits bites me once again.

Is there any reason behind not listing the implemented traits in IoResult's docs? Listing the implementors in the trait is not very useful since in the first place you have to know which traits are implemented to consult them. It's backwards and counterintuitive as I see it.
everybody*

* not everybody
Pesticide: Faster CSS layout debugging
> The court found that even if all allegations in her complaint were taken to be true, they still would not establish that Warner Brothers was bound by that contract.

So it is possible that:
1) X sells rights to Y, having Y commit to obligations in exchange.
2) Z acquires Y.
3) Z now has the rights but not the obligations.

WTF?
Makes text uncopiable in all browsers. Combined with entity-encoded source, this could make a decent protection against most users. Not that I approve such things.

[edit] unicode encoding (\67). html-entities do not work.
> Not only is this why online advertising is ultimately doomed, but it's why we hugely and desperately and badly need to find another way of paying for content.

Another viable option is letting a lot of the content die. I'm sure we can all live without knowing that one neat trick that you won't believe.

In your proposal:

> ... constant challenge for any creative type is making a living.

Well perhaps if that's the case what you do is not valuable to anyone. Over time economic cycles destroy things that were once valuable. There used to be whole industries selling ice from icebergs in London. I bet they were rather upset when domestic refrigeration became popular.

Music as a physical medium is no longer very valuable due to a nexus of the proliferation of arbitrarily reproducible data systems and a decrease in the perception of value of non live performance music.

The suggestions of a broadband tax etc are insane and the work of lobbyists and other socially destructive parasites.
That sounds like server load, more than anything on the client side. When I used it everything was instant and snappy, so it might just depend on the number of visitors.

Blowing away the stack by clicking is a bit of a pain. A couple of times something buggy happened where new pages overwrote some part of the old stack, but left the rest of it in place. I would like to see some option for expanding multiple branches at one level, but at that point it is probably a UI specifically for me rather than something that is generally usable.

One thing that was cute was that the stack of pages is exposed in the URL, which suggests that some nice greasemonkey tricks would be viable.
The Open Plan Office and the Extrovert Ideal
It's important to grok why OS programming "has always been mostly a university thing" in contrast to, say... a business environment that wasn't monopolized by anti-competitive business practices and set back for decades as a result, or maybe a vibrant ecosystem we all grew up wanting to contribute toward and understand deeply with low barriers to entry and a supportive community.

The same could be said for understanding why "the ecosystem for multimedia weren't (and isn't) very good on Linux" and various rounds of the DRM wars.

Microsoft shouldn't be blamed forever for deficits in free software and that's not an argument I'm trying to advance, but it would also be a mistake to overlook their historical influence on when and where certain barriers to tinkering emerged or persisted.

I think that's part of why this triggers a disgust response for some commenters.
Line 21 here implements Writer for IOResult<T> where T also implements Writer: https://github.com/rust-lang/rust/blob/master/src/libstd/old...
rtrivedi - do you have an email I can reach you on? I work for the company that helps Medicare.gov (and a lot of other govt agencies) publish their data online in machine readable formats and I'd love to get feedback from you and understand how you're using the data and potentially make the data publishers aware of this use case as well. You can reach me at mark.silverberg@socrata.com if you prefer not to post your email publicly.

Great job!
Putting aside question of "free" sites revenue, blockers and other similar questions. How could anyone call Ads "effective"? I have never seen an Ad that I would consider useful or even honest.

Massive carpet bombing advertising has instead a negative effect for me. If I'm buying stuff that is heavily marketed, for example toothpaste, where everything has Ads, and I see one brand that is not advertised and it is more or less similar to others - I'm buying it.
The state of Linux is far more a hindrances for it's success as a learning tool than Windows ever was. I've been using Linux since '98, it's great for learning systems administration or networking. It's however lacking in most of the other areas of computing, those which yourself like many other apparently are quite ignorant of. I learned far more from windows than I ever did Linux, including advanced OS concepts.

That Microsoft is coercing people to use Windows is the favorite conspiracy among Linux evangelists. The reality is that Linux isn't and never was very approachable. You might not be able to dive into the source code of Windows, but at least your not stuck trying to understand yet another build system. At least there are decent learning material so you don't need read the source code or scavenge through mailings list trying to find something other than "why do you want to do that". Or a countless other examples like it.

I like Linux, I do. But you can't have your cake and it too. It's not as good as Windows if you want to have access to all areas of computing. Which is what you want when you teach computers to a wide verity of people.

Maybe you should be more concerned that most ARM devices doesn't have working graphics acceleration for Linux desktop systems.
In general, we're still working on a number of usability issues with Rustdoc's output. The one that bits the most people is methods through Deref. Luckily, this is just a tooling issue, a small bug to be fixed, rather than some sort of fundamental problem. The beta cycle is going to be all about polish, and issues like this are a good candidate for that kind of work.
No true blogger would wilfully misunderstand a buffer overrun vulnerability in order to score some cheap pageviews.

To put it simply, his examples are the equivalent of doing this:

unsigned char data[4096];
#define X (*(int *)(&data[0]))
#define Y (*(int *)(&data[4]))
...

Basically, he's explicitly re-using a buffer, no buffer was overrun. In Rust you will not read something out of a buffer you didn't put there first, in C you can, and you might even read several GB out of a 256 byte buffer.
Meh. Seems okay to me. I'm not convinced the chart really tells us anything at all. http://www.google.com/trends/explore#q=linux%2C Microsoft
I mostly agree with the premise: logic errors are always going to be there, at least until the compiler is an IA strong enough to catch them for us (and by then we probably won't need coders anyway...). There's no silver bullet, bad coders are always going to produce. And I also don't like it when people claim that bug X or vulnerability Y wouldn't have happened if they had been technology Z, they're just begging for that type of post.

That being said I'm a bit more skeptical of this part: "code no true C programmer would write : heartbleed :: code no true rust programmer would write :: (exercise for the reader)"

If I look at the examples in the acticle, the C version doesn't look that terrible and contrieved to me. I wonder what the author means by "Survey says no true C programmer would ever write a program like that, either." That looks like a lot of C code I've read, there's nothing particularly weird about it.

On the other hand the rust version looks very foreign to me (and I've been writing quite a lot of rust lately). You basically have to go out of your way to create the same issue.

I guess my point is that while it's true that as long as there'll be coders there'll be bugs and security vulnerabilities it doesn't mean we shouldn't try to make things better. And in my opinion Rust makes it much more difficult to shoot yourself in the foot than plain C.
This combination seems like the exact opposite of what an IoT platform should be.
Wow this takes me back to busting into Windows 98 via the Help > Print > something > Explorer method.

Actually, someone linked to something like it in the comments: https://i.imgur.com/n9Th4q5.jpg

I can't imagine how difficult it must be to secure a login system with so much added surface due to accessibility and dumb users.
For one, the title is the same...
I think you answered your own question didn't you? Those companies were 'bailed out'. The government didn't just wipe out their debts by fiat; it gave them money.
Didn't we just establish that it's the system that kids already know more about?
Chocolatey looks nice actually. I might have had more fun on windows when I used it in the 90s if that had existed. I will keep it in mind in case I ever see a need for it, I imagine I could suggest it to some windows users.
> I would also recommend it for studying operating systems

Perhaps not if you plan of contributing code to any open source OS. Practices like this can leave projects exposed to intellectual property violations.

This is why reverse engineering usually requires more people, each who isn't privy to the previous persons source material.
Fabriquartz - Arnhem - The Netherlands - Junior Web Developers

We are a startup working on an planning tool built with Ember.JS and Ruby on Rails.

Interested or for more info write to marten.schilstra[at]fabriquartz.com
Far more interesting than a simple exploitation of the 'content' CSS attribute.
user comment on imgur: "As a network manager, disable startup repair via group policy. Fixed."

Does this fix it?
Show HN: Send glitter, confetti, rude postcards and other stuff anonymously
I used to think a broadband tax was a good idea, but I now worry that it would give politicians too much leverage over content producers.

It is easy to see how they would try to ban porn, non-mainstream ideology and other inconvinient content from the system.
Or at least electoral boundaries that didn't unfairly benefit Labour
Some are CPM/RPM, some are CPC and some ultimately require an arbitrary "action" which can sometimes be a conversion.

There are plenty of ad networks that will pay you some nominal amount just to display an ad to 'users.'
If your customers have machines that can be hijacked by drive-by malware, then blocking ads is not going to help them much in the long run.
Remember Me Safely – Secure Long-Term Authentication Strategies
Entrepreneurship and the emotional fluctuations
No, Microsoft has this Windows Research Kernel they offer to universities and other organizations under a certain strict agreement. This particular site probably has no idea of what access control, or directory access rights mean, so it's easily accessible for anyone.
I did much the same thing in Python a while ago: https://github.com/borntyping/python-infix
monopolistic and anti-competitive business practices-which Microsoft is well known for-have been significantly harmful to large numbers of people.

there are plenty of "business-oriented decisions" that are bad for others; being pro-competition or anti-monopoly is not the same thing as being anti-business in general, as you seem to be implying here.

the poster was talking about Microsoft's use of network effects as an anti-competitive strategy, not about criticizing a company attempting to make money.
Good work, can't wait to check this out.
> I consider myself a technical person and while I think it's fun to use Linux, it's certainly not productive.

Should read: "...I'm certainly not productive."

Just because you struggled with the Linux paradigm, it doesn't mean that it's an unproductive platform.
Patreon is saving the world, not AdBlock. It's still early but I expect in 10 years that "trying to make money via ads" is going to see "very 2010s", due to the lack of words for "something done from the late 1990s to the late 2010s".

It just doesn't work. It almost works. It is so painfully close to working that we can taste it, which is why it has hung around so long. But eventually, advertising corrupts all souls. People respond to incentives, no matter how hard they try not to, and nobody sane should really try to build a quality content-production regime on people trying really hard to act as if the incentives they are operating under aren't the incentives they're operating under. Even when it "works" for some period of time I question the effects of such long-term self-deception.
New Jurassic World Trailer Hides Improved CGI in Plain Sight
Show HN: Evergig – Multi-angle concerts by aggregating fan footage from the web
What I'm trying to say is that social mobility will be severely stunted.

We can agree that the reason for owning land is to make money, yes? Planting crops would take a couple of months to return the initial investment. If I planted a forest it could take years.

If this investment possibility is removed from everyone without (massive amounts of, if the tax is high enough) capital it's going to create a further wealth gap for no apparent reason.

> Finally the poorest cannot afford to own land anyway so are not affected by the land taxes.

Yes, this is true for the poorest, bad phrasing on my part, but it is going to make the barrier of entry higher.

Also: land produces goods that everyone need the same amount of (food, wood, wool), this would increase prices in a way that wouldn't really bother the capital heavy but would seriously hurt the already poor.
Bamboo Talent (www.bambootalent.com) - New York, NY

We are a talent search firm, working closely with NYC's tech community, acting as a true business partner to growing organizations looking to scale their engineering teams. We care about customer service and operate with respect, honesty and integrity in every communication.

As many organizations in this space are competing for the best engineering talent, we help to accurately represent both company and opportunity to the potential candidate. We meet every client we represent, to ensure our ability to answer your questions. We focus on understanding our clients’ needs, and thus allowing you to make an informed decision on whether or not it makes sense to speak with them.

Some of our clients’ current needs include:

-Senior Python Engineer (Python) - EdTech Startup

-Infrastructure Engineer (Golang) - Post-IPO E-Commerce Company

-Golang Engineer (Go) - SaaS-based Data Analytics Startup

-Front End Developer (JS, D3.js) - SaaS-based Data Analytics Startup

-iOS Engineer (Obj-C) - Pre-IPO E-Commerce Company

-Android Engineer (Core Java) - Pre-IPO E-Commerce Company

-Full Stack Engineer (Ruby) - Big Funding, Knowledge Platform Startup

-iOS Engineer (Objective-C) - Big Funding, Knowledge Platform Startup

-Android Engineer (Core Java) - Big Funding, Knowledge Platform Startup

-Javascript Engineer (Raw, Vanilla JS) - Big Funding, Knowledge Platform Startup

-Lead Front End Engineer (AngularJS) - Startup at Intersection of Big Data & Bioinformatics

-API Engineer (Scala) - Startup at Intersection of Big Data & Bioinformatics

-Applications Engineer (Ruby) - Startup at Intersection of Big Data & Bioinformatics

-Data Engineer - Startup at Intersection of Big Data & Bioinformatics

-Data Scientist (Machine Learning) - Startup at Intersection of Big Data & Bioinformatics

-Back End Engineer (Python) - Data-focused Startup in Customer Service Space

-Web Applications Engineer (Python or PHP & Javascript) - AdTech Startup

-Javascript Engineer (Core, Native JS) - AdTech Startup

-Back End Engineer (Python) - AdTech Startup

-Front End UI Developer (HTML/CSS, Responsive) - Early Stage, Data Critical Startup

-Senior Back End Engineer (Ruby) - Early Stage, Data Critical Startup

-DevOps Engineer (Chef, AWS EC2) - Early Stage, Data Critical Startup

-Full Stack Engineer (Ruby, Javascript) - Early Stage, Data Critical Startup

-Senior Software Engineer (Deep Python) – Series A Funded B2B Platform Startup

-Senior iOS Engineer (Objective-C) - Series A Funded B2B Platform Startup

Please get in touch to learn further details on these and other companies/roles we are representing.

email: jon@bambootalent.com
> Maybe she had incompetent representation.

She talks of "net profit", not "gross profit", so that's a possibility.
No, it's not real: https://news.ycombinator.com/item?id=1822593
Even though its Windows 10, the fact its ARM means you won't be able to run most desktop Windows software. Unlike Linux where most things have already been ported to ARM (thanks to open source!).

People will discover the limitations very quickly, especially compared to Raspbian/Ubuntu/OpenSUSE/etc...
Openssl uses their own memory allocator (since malloc is slow on big-endian x86 xenix or something) so they _do_ reuse memory without clearing it in between. Had they used the system malloc, it wouldn't have been vulnerable (on OpenBSD and probably elsewhere). Can rust prevent you from implementing your own (buggy) memory allocator?
To me it makes it more obvious that succinct != more readable: (top two) http://rigaux.org/language-study/syntax-across-languages/Fnc...
The numbers do not show a full picture. A lot of people in Europe own a car but use it only occasionally -- going on holiday, weekend trip etc., and still use a public transport - which is well developed in most (even smaller) cities - for everyday commuting.
I'm a fan of weave. Is remote a possibility? North America - east coast - short hop across the pond, not so bad tz difference, etc.
PH should just let site owners add a meta tag asking to not be "hunted" (a la Pinterest "nopin")... the whole badge thing sounds like a free marketing campaign for PH.
'linux' is a single keyword, while GNU/Linux OS might show up as a wide set of different keywords, like ubuntu, debian, mint, arch, centos, rhel, fedora, gentoo, opensuse. Note that this is not the case with Windows, iOS, OSX. So, it would be interesting to see the combined interest of all those added to that of 'linux' for a more correct perspective - not considering Android of course, since it's not a GNU/Linux system.

BTW it seems interest in Windows is also halving every ~10 years (though not as fast as 'linux'):

http://www.google.com/trends/explore#q=windows
I would also be curious if you are able to reach 100Mb with your pi
Ask HN: My China friend sent me this pic. What do you think the girl's doing?
I feel like you're undervaluing memory safety. Memory safety prevents most (all?) exploits that lead to remote code execution. There can still be high level vulnerabilities, but guaranteed memory safety is a huge improvement.

Rust's type system can be used to prevent high level attacks too. For instance, if an sql library is set up properly, it can prevent sql injection by requiring inputs be properly sanitized.
Physical access and all bets are off. This is not a vulnerability.
Exactly because the situation is reversed: the banks are much more likely to be strategic and self preserving than the general public, due to concentration of power and many other factors.
> No true blogger would wilfully misunderstand a buffer overrun vulnerability in order to score some cheap pageviews.

You may want to read up on Ted, and realise that when he writes

> if we don’t actually understand what vulnerabilities like Heartbleed are

he's probably talking about you.

> Basically, he's explicitly re-using a buffer, no buffer was overrun.

Which is essentially what happened in heartbleed. Heartbleed was not a buffer overrun at any point.

Here's the tl;dr: during heartbeat, OpenSSL would malloc both input and output buffers at the caller-specified size (65536 bytes), copy a caller-provided input (1 byte) to the input buffer then copy the whole input buffer to the output buffer.

Anything beside the overwritten byte would likely be previously written data since neither malloc nor free zero out their stuff by default[0], essentially leaking 65k of random data every time.

This was compounded by OpenSSL doing its own memory management via freelists, making it even more likely interesting data would be present in the input "garbage" and precluding OS mitigations (such as BSD's malloc.conf framework[1]), not to mention the unmitigated (no freelist) codepath had bitrotted and didn't actually work even if you knew how to enable it[2]. Note that [1] and [2] are by TFAA, and that he's an OpenBSD and LibreSSL core contributor.

[0] http://www.seancassidy.me/diagnosis-of-the-openssl-heartblee...

[1] http://www.tedunangst.com/flak/post/heartbleed-vs-mallocconf

[2] http://www.tedunangst.com/flak/post/analysis-of-openssl-free...
HAHA, Interesting point! I hadn't thought of it as a marketing campaign for them...not sure that they need much marketing :) But I did originally want a more high tech option than just badges. Incidentally, I started to just like the idea of badges as a public commitment to build hunt-worthy products.
Yes it is, but it makes much more sense for git to use it: if a single byte is changed somewhere, you only need re-hashing the file and the trees up to the root; the other blobs/trees are left unchanged. It is very useful in this setting to reuse older existing hashes. In bittorrent, OTOH, we suppose every swarm will share different content, so there was no point making sure a hash would be reused somewhere.
Yes, because we don't support custom allocators yet ;)