skysight-inc/HackerNews huggingface dataset:
"(As far as I know, it is still unresolved whether the MIT or BSD licenses include an implied grant of patent rights, but at the very least there would be serious legal uncertainty.)"

It's not really unresolved. There are dreamers who believe it's not the case. For everyone else, it's clearly the case until proven otherwise. There is a ton of case law on implied licenses. To believe it would simply not apply to software when it applies to every other area in which there are patents, for some magical unknown reason is ... strange and weird legal thinking?
Paper on Copulatory Vocalizations in Women Not a Reflexive Consequence of Orgasm
"Never attribute to malice that which is adequately explained by stupidity." My guess is that one of the police computers is infected, but it shouldn't be too hard to install this malware on a VM and see where it phones home.
Because all of those sites are established and have unparalleled content. There are no competitors to those websites.
Reinventing programming is still a new field. We aren't really sure what is possible or not, and there are bound to be overly optimistic as well as pessimistic predictions.
That part of your comment wasn't off-topic, but the part about "chest-beating" was, and it provoked a wildly off-topic digression. Had you followed the HN guidelines and limited your comment to its substantive and civil portion, I don't believe that would have happened.
Space X: Vine of the crash landing
I for one appreciated all the "I"s! To me it shows that you understand that you are expressing a subjective opinion, not a fact in the world. I think too many people express opinions as facts with puffy language.

Compare yours to "Apple's admirable open source program is genuine and legit. If you've unfairly dismissed them in the past, give them a second look."
'Sequel', because even though it's grammatically incorrect, it rolls off the tongue much better.
ARM? I thought most routers used MIPS. At least several of the ones I've used are.
You take a sub roll, split it in half, slather it in mayo, layer on meat and cheese, then throw it in a pizza oven until the bread is toasty and the cheese is melted, then add the veggies. That is a grinder. Everything else is just a sandwich.
If individual instructions are faster, that means the instruction decoder isn't as good as it should be. BOUND wasn't fast because it didn't get any use, and it didn't get any use because people thought it was slow... but now that the usefulness of this instruction is apparent, it seems to me that they should make the decoder issue the necessary uops and make it at least as fast as the (bigger, more cache-wasting) sequence of simpler instructions.

Instructions like MOVS and STOS used to be slower than the equivalent series of simple instructions, but now they're much faster. Even the more obscure and far less useful BCD arithmetic instructions have been made on-par with a longer series of equivalent instructions[1] so not doing the same for the much more useful BOUND is... unusual. The amount of silicon needed to implement MPX (which includes several new instructions) seems far more than it'd take to make a BOUND decode faster.

[1] https://news.ycombinator.com/item?id=8477585
That's a thoughtful question.

Let me ramble...

1) I'd say the "fit and finish" is remarkable. But everybody probably likes what they've got with their OS, so maybe that's not worth much.

2) If you're into firewalling/networking, it does have the venerable ipf, OpenBSDs pf, and the shiny-new npf for packet filtering -- and the network stack that held the Internet "land speed" record. Twice[0]

3) there is remarkable kernel research that is going on, that research makes the kernel available to YOU[1][2]

4) pkgsrc is topnotch. And others use it too, so like the famously portable OS, the 3rd party software is tested in the realworld on disparate machines.[3][4]

5) The community is small enough, friendly enough, and smart enough that it's simple to get into and has a high signal-to-noise ratio.[5]

6) Other interesting security[6], virtualization[7]

7) Good documentation, good code (forged by years of portability -- getting code running on so many different architectures doesn't happen by accident, and the lessons are carried on. And to be clear, unlike Linux, the NetBSD code that runs on (eg) a Vax is from the same codebase than runs on an 8-way amd64... versus (afaik) Linux where ea. target is pretty much a rewrite.)

8) I could go on... if you have more questions, don't hesitate, or better, drop in on #netbsd IRC channel on Freenode[8].

[0] http://www.netbsd.org/gallery/research.html#internet2-landsp...

[1] http://netbsd.gw.com/cgi-bin/man-cgi?lua+4+NetBSD-current

[2] https://wiki.netbsd.org/rumpkernel/

[3] http://pkgsrc.joyent.com/

[4] https://github.com/minix3/pkgsrc

[5] https://www.netbsd.org/community/

[6] http://en.wikipedia.org/wiki/Veriexec

[7] http://en.wikipedia.org/wiki/NetBSD#Virtualization

[8] irc.freenode.net

Edit: Match my parens, s/to/too/, link to freenode.
I actually can't see how this epitomizes a failed Pitch. Sure, he was struggling a little bit, and towards the end went off the rails.. but generally if this summarizes what a 'poor pitch' is like, then we're in pretty good shape.
I agree Ballmer was not "one of the worst CEOs in history", but Bush will quite certainly rank among the worst presidents in history. Bush's two war mistakes were gargantuan, scholars estimate over one million war dead in Iraq, in addition he accelerated the decline of the American state in numerous other aspects.
Yeah. With the right security software on your device and the right options on the server you could theoretically initiate a properly secured connection with some web sites, requiring DNSSEC, STS, etc., but for general purpose use you need the VPN.
That would be ideal and would hold LEOs to higher standard, but in reality, the exact opposite happens.
It's actually not "still has" - this was a major feature that brought significant performance improvements and something they pushed hard for: http://www.microsoft.com/technet/prodtechnol/WindowsServer20...

(Not saying I agree or disagree, just saying that this isn't so much an ancient artifact as it is a fairly recent and purposeful addition.)
Does anyone know if they're planning to hotfix Azure PaaS servers? They just pushed a new update on April 2nd [1] but that did not include MS15-034 [2]. I really hope they don't plan on waiting a few weeks before pushing this out.

1. http://azure.microsoft.com/en-us/documentation/articles/clou...
2. http://azure.microsoft.com/en-us/documentation/articles/clou...
A non-memory logic error that allows remote code execution by breaking the stack? Can you give an example? Most of the examples I can think of are either directly or indirectly a problem of memory safety (for execution remote code rather than simply crashing (like a stack overflow)).
From what I've heard recently, targetting ARM may be problematic because two ARM processors may not support the same features, or function the same way. Then again, maybe there's a low-end subset of ARM instructions that should work an any chip, similar to the instruction set for the i386?
True, but in research it is expected. I would guess development is much more conservative.
Show HN: Nginx module which enable HLS adaptive bitrate and more
I think mongodb is following a similar path to what MySQL did. Be really good at one thing, market as something else -- and then slowly, slowly catch up to the hype (sort of).

As I understand it mongodb have changed the default settings (probably why someone downvoted you) -- but the fact that it was off by default is still something that is rightfully hard for the team to live down.

And while a lot of people are probably still happily using MySQL -- I personally see little use for it, when PostgreSQL is an option.

I maybe wrong, but I think both mongodb and mysql appeal to the same groups: people that don't know or care about normalization, databases and datastructures -- and really just want image (as in Smalltalk) based development, but has been tricked into using php/javascript etc.

It's kind of crazy that you have two mature (one Free, one free) object databases that have seen some real-world usage -- and neither get any love.

One is zodb, the Z object database, developed for zope/plone -- one of the first web application frameworks -- and a major contributor to python (invented eggs, buildout...). It's ridiculously easy to use outside of zope/plone/pyramid[1] and now has a free replication service[2].

The other one is gemstone glass[3] which works with Smalltalk and have their own ruby runtime, maglev[4].

[1] http://zodborg.readthedocs.org/en/latest/documentation/artic...

[2] http://www.zope.com/products/x1752814276/Zope-Replication-Se...

[3] http://seaside.gemtalksystems.com/

[4] http://maglev.github.io/
Factory firmware on SOHO routers is notoriously terrible. You'd think that this would be a good place for a startup to disrupt. The hardware is basically off-the-shelf components. It would be an easy sell to experts, but maybe harder to get traction with most people.
I've been working with openresty (ngx+lua) for a few months now and I love it. If you know nginx you can get started with it in a couple of days.

The idea behind it is simple. It introduces a set of directives that allow you to execute lua code. Some of these directives are completely new while others are meant to compliment nginx's native directives. Eg:

the `access_by_lua` directives is meant to execute lua code after nginx's access phase handler. Where as `content_by_lua` has no nginx equivalent.

I haven't used the MVC frameworks built with openresty myself but that was only due to lack of research on my part! I wish I had taken time to see what options were available.
Elon Musk inviting John Carmack to work on rockets
SF companies trying to hire people. Anyone in SF who would like to derive the benefit of the labor of low wage earners (teachers, nannies, chefs, etc).
Market salaries are for rank and file coders. Build something that's wildly successful, and it won't matter what the language was.
He said non-interlaced. You had to buy (an expensive after market) scan doubler to get rid of the flicker on the Amiga. Biggest mistake they made .. they should have included a true workstation class high resolution mono video mode.

Doing productivity apps on the Amiga in its highest resolution vs the Atari in its highest (monochrome) was no comparison.

The Atari did better in certain markets -- MIDI sequencing, big time, and to a much lesser extant DTP -- because of this.

But having that nice mono screen for productivity didn't make the ST a big success, so I don't think the original comment stands.

The Amiga was not a success because it wasn't an IBM PC.
To clarify, you probably got downvoted because it doesn't contribute anything. We have upvotes for agreement.
The details of CVE-2015-1635 seem to still be undisclosed, but given that it's an HTTP praying issue I wonder if running IIS behind nginx or another reverse proxy (a very common configuration) would help any? It's not listed under mitigating factors, but maybe that's really less of a mitigating factor and more of a "doesn't apply" situation?
One little jab in the entire thread by me. Not mean spirited but an accurate description of what people do.

All in all, I thought I was quite patient and I explained why I thought we can, and should try, to have more intelligent discussions on HN. I'm afraid that I didn't convince the other guy.

"HN comments sections cannot be more than superficial"

Anyway, I'm sure the moderators will figure it out before we become TIL on Reddit:

http://www.reddit.com/r/todayilearned/comments/32m5t5/til_ew...
Except we are talking about the English language. And it does have rules, they are called grammar. Plus, you're using the bandwagon fallacy. Just because a lot of people do it doesn't make it right.
mixAndPermute is actually 'RSA' encryption; the modulus factors as 43 * 47 and the public exponent is 5. Inverting it is a matter of computing x^773 mod 2021.
Of course they did. So did the OpenSSL developers. It wasn't an accident. It's simply a design decision that has a set of costs associated with it.
Awesome. In the US, just discovering that script would probably get you a visit from Federal marshals, much less reverse-engineering the hash to discover your own account number.
Cigarettes, damn cigarettes and statistics
False positives are also a problem. In particular, there are stories of "Hello World" programs being detected as malicious.
Yep same nonsense on the Atari. Computer vendors back then really did frustrating things around peripherals. It was bad enough they were so expensive, but external disks, monitors, mice, RAM everything was proprietary, which made it worse. Eventually things settled on SCSI, then IDE, but there were many years there where it was wild west on standards for all of the above.

I just bought an Atari TT off eBay. It will nicely drive a VGA monitor, but not for its highest resolution (1280x960), for which it needs a special ("ECL") monitor. An adapter from that to VGA is $175 from a hobbyist -- almost as much as I paid for the computer.
Just to hazard a guess, there's probably little organizational incentive to prevent security issues in the first place.
A zine about strace
I described a relatively simple protocol that monotonically increases the security of a communication

Careful. Encryption is decryption, remember. Do any of the rounds of CC undo any of the rounds of KC? Can you verify that bits that were correlated in PT and uncorrelated in KC are still uncorrelated in KC + CC? Does CC change the entropy content of the resulting message? (If it decreases it you have a problem, and most popular ciphers end up with damn near 8 bits per byte in the ciphertext.)
If ever I was, you just took over.
Fair enough, perhaps upvotes should be visible. Thanks
http://netbsd-news.me/ seems to be misconfigured. It returns a page from http://www.saveosx.org/.
That's chilling. Shame on them.
At this point, there is absolutely no evidence, beyond the defense attorney's claim, that the malicious software neither existed prior to him handing it over to the police department, nor that it was installed after the fact, by the defense attorney. It is just as likely that, in either of those possibilities, this is a self-inflicted attempt by the defense attorney to discredit the police. Arstechnica, and every comment that I've read, both there and here on YC, reach conclusions based on a potentially, and just-as-likely-false, premise: that the act of the software installation occurred as a result of some action or inaction of the police. False premise = potentially false conclusion. Brains, people, brains. Use them, please.
You could make that argument about anything. People who use credit cards need to do their research and understand the 200 page card agreement, so we shouldn't punish lenders by having consumer protection laws.

Startups are exactly this same sort of risk, except it's even worse - there aren't even terms and agreements saying exactly what's being received in return for money. There's no way crowd funded equity owners are going to get access to due diligence that would make it a responsible investment. And there's no way way, ever, that a startup makes sense from a responsible investing perspective to a random Joe off the street. It's essentially a lottery ticket because there's no way to accurately assess the value and risk of what they're investing in, and even if there was any sane financial planner will tell you it's a bad investment for regular people.
Pumped hydro works very well. Its main issue is that the enabling favorable combination of terrain (adjacent lakes or potential lakes at differing heights) and water supply aren't common, so cost-effective sites are restricted.
Great guide, but Chicago's best sandwich, the jibarito (http://en.wikipedia.org/wiki/Jibarito) was overlooked.
•	Kernel-mode caching. Requests for cached responses are served without switching to user mode.

-- NT is missing sendfile()? Also syscalls are fast on x86_64, most stuff is dynamic now a days and serving static files straight from page cache is fast enough.

•	Kernel-mode request queuing. Requests cause less overhead in context switching

-- This one is somewhat valid but given you can ctx switch pretty fast on modern CPUs it is not clear how big the gains are.

Yeah but there would be some gains - that's not deniable. Question is whether they are big enough to risk something like the vulnerability at hand.
hmmm...i watched the video of kyle pitching and i understood what was talking about. i don't see what was so bad about it. to me, given the interruption-laden flow of the dialog, it was as clear and concise as you could probably expect (though i'm sure the pitch got better over time)...but i'm a developer (the target). i think the problem was not necessarily the content of the pitch, but the fact that he tasked with getting a non-developer (or one who's been out of the game) to understand the specific problem he was addressing - in an artificially short time frame. ...he was also talking to someone who was desperately trying to put his idea in a box so he could understand. it's too bad that kyle took it so hard. it's great to share this experience with others so they can learn that pitching is hard and doesn't always go your way. practice, practice, practice.
I need to see a citation for this

You're looking at it the wrong way. You need to demonstrate for yourself that nothing in your cipher undoes the last round of the underlying cipher.
Town Hall Deli! I miss you so much.
Things like this make me think of an alien David Attenborough commenting on humans.

"and here we have the spartans, a strange group. After birth they attempt to drown their young in fermented grapes..."
The Pi doesn't have a BIOS or EFI on board, it uses a special partition on the SD card to POST from, so there's no worry of the device itself being infected.

It might be possible for a malicious script that gains root access to replace the SD card firmware with something that looks clean on the Pi, but delivers malware when some conditions are met.
Thanks for your reply. Do you have any recommendations?
Now that I've finally re-watched it, I can't help but agree. I definitely sounded like a jerk (and probably a fairly stupid one). It's funny how one's defensiveness can be interpreted :(
I used to think so too. But then again, is it advisable to start a startup just for Y Combinator?
Here is a relevant StackOverflow question with many answers from visually impaired and blind programmers:

http://stackoverflow.com/questions/118984/how-can-you-progra...

One thing I learned is that you'll want to avoid python because it relies on significant whitespace.

I'm wondering if golang would be a good choice since it has lots of great language tools, including gofmt, which will help you collaborate with other developers in terms of writing clear well-formatted code.
Do you always twist your words or just sometimes
Thanks for the feedback, I totally understand your reservations with all the crap out there on the internet.

We just thought a thorough resource for digital nomad gear should exist so we did a weekend project to create one.

A lot of the products aren't even on Amazon. It's a mix of stuff that we own and use, suggestions from friends and people on the nomad slack gear channel. Almost all of our content is original by the way.

Right now we're thinking of ways to make it more user content based, like finding experienced nomads to share what they use (gear lists). Also ranking products by users and/or user entered products.
That will only work for direct writes to array variables on the stack, or pointers which can be proved to live on the current stack frame, but those are quite rare; e.g. in the vulnerability mentioned in the post, it's sprintf doing the overflowing write into its parent stack frame, but sprintf could be called with any pointer. If, say, you narrow the trapping region to some unused region of the stack frame to try to avoid this, you can get slightly better protection than a stack canary, but not much better. And most overflow vulnerabilities in modern software seem to be on the heap anyway.*

(Which is not to say primitives based on fine-grained tagged memory couldn't do some interesting things; OpenRISC has some form of this, but I haven't looked into it in detail.)

I don't see content on the linked page corresponding to data structures where managing bounds explicitly is difficult, other than the bnd_variable_size bit, which is described as rare.

*corrected to state that I'm only considering overflows, not, e.g., use-after-frees, which aren't related to bounds checks
Maybe the Arstechnica article is biased towards the defense attorney's side of the story - but I definitely don't see the primary issue here as being law enforcement officers installed said software (as you pointed out, this is yet an unproven hypothesis - though quite a likely one perhaps). At least for me the substantiated and proven issue is that the CID Special Investigations Unit refused to investigate whether such a thing occurred.

> Brains, people, brains. Use them, please.

Adding insults to your comment does not make for a better discussion.
My understanding is that nuclear power is used to serve base load, which is the demand that isn't subject to significant variation. This allows generator owners to run nuclear generators at their cost-effective maximum output.

It's true that there is great variation in electricity pricing, with peak shaving and other so-called "ancillary services" bringing as much as 100X as high a price as base rate (for a short period of time). Nuke generators aren't capable of rapid load following, reactive power correction, voltage support, or other fast-response services that bring premium power prices.
BOUND didn't get much of an use because it is useful only for bounds checking of the "dump core if outside" kind.
If Finland is anything like Denmark, not enough money is probably not the issue. Bank IT is a pretty well-paid job here, near the top of the scale for programmers. But nonetheless has a reputation for being poorly run and just somewhat boring, with a workplace dominated by "suits". In fact you might have to actually wear a suit to work yourself. So it attracts people who want a stable job with no overtime and a large paycheck, and are willing to put up with high management overhead and banking-sector culture.
I agree with many of Singer's arguments, but there's one crucial distinction that needs to be made: We may care about animals, but animals don't care about people. Almost all animals are sociopaths. The biggest reason your cat doesn't kill you is because it's not big enough. Big cats do kill people. Even our closest relative, the chimpanzee, has been known to kill and maim human adults and children without provocation.[1] They have even, without warning, viciously attacked humans who raised them.[2]

While I don't think it's ethical to breed and slaughter sociopaths for food, I do think animals' lack of morals means we should care little about their well-being.

1. https://en.wikipedia.org/wiki/Common_chimpanzee#Attacks

2. http://www.esquire.com/news-politics/a5609/chimpanzee-attack...
I can't find much public information about this vulnerability other than the Snort guys indicating this is a range header integer overflow attempt [1].

Anybody else have anything to share?

[1] https://www.snort.org/advisories/vrt-rules-2015-04-14
Interesting. I've never lived in Japan/South Korea, but in mainland China (1.4 billion people) as far as I can tell it doesn't exist. Never seen in Thailand, Laos, Vietnam either. I'd be surprised if it exists in India. Probably does in SG/HK, but who'd live there? :)

(PS. Typical HN this thread .. make a valid comment, get called out on a tangent and voted down to obscurity. At least we're all learning something ;)