skysight-inc/HackerNews huggingface dataset:
"Sidejacking is a term Graham uses to describe his session hijacking hack that can compromise nearly all Web 2.0 applications that rely on saved cookie information to seamlessly log people back in to an account without the need to reenter the password."

and

"Web 2.0 is fundamentally insecure because data isn't encrypted"

Uh no, many "web 1.0" (and 1.2, 1.5, 1.6, 2.6, 3.0, AND 3.3... but not 1.8 or 2.5) sites are also vulnerable... it has nothing to do with a particular version of the interwebs.

Anyway, from Robert Graham's article it sounds like XMLHttpRequests that are normally protected by SSL will fallback to non-SSL in the case of failure. Normally that should never happen, since http and https are considered different "origins" in terms of the same-origin policy. I couldn't tell if this is a browser issue, or if Gmail is doing something crazy. Either way, it's a big problem and should be fixed.
Yeah, I wish he'd been clearer about that. I'll take a stab at deciphering it though:

You've just connected your laptop's wifi to a hotspot (i.e. associated with the access point) but haven't yet logged in/paid. Connection attempts will now either re-route to the hotspot operator's login page or just fail, depending on how the hotspot is set up.

Now, suppose, for whatever reason, gmail is still open in your browser from a previous session or whatever. It will keep trying to connect to the server via https, which fails as there's no route to it, and (according to the article) fall back to http. (which will also fail, but can be intercepted)

I don't see how this will work unless you've still got the gmail client-side scripts executing from your browser's cache. Simply navigating to https://gmail.com/ will fail, and the retry/redirect won't ever happen.

Disclaimer: I don't know the inner workings of gmail; I've never looked into how gmail works at all.

Edit: spelling
If a boat's anchor can accidentally sever a major backbone cutting off several countries from the Internet, just thing what a terrorist could deliberately do...

I've always wondered how you would go about fixing a cable deep in the ocean.
"Which webs?" - "All of them."

http://www.penny-arcade.com/comic/2007/07/16
Google maps and gmail are "dysfunctional" and behind MapQuest and hotmail or yahoo mail?

I don't know (personally) a single hotmail user, AFAIK people only use it for spamboxes. And MapQuest? WTF?
So I was at this wild assed party last weekend and suddenly realized that all the damn girls were taking pictures like crazy. Most supposedly showed up on facebook the next day. Damnit.

Traffic light cameras aren't destroying our privacy, it's girls with cameras.
Facebook, LiveID, open ID, roll your own or all of the above?
So I'm interested to get a feel on what peoples current thinking is around authentication on a new web application and how they have handled it? There are numerous choices as I've mentioned in the title and it seems there is no real guidance on which (if any) is the most suitable for new applications?

I can the see the appeal of rolling your own auth system in terms of obviously you get to control it, however if I go across to the other side of the fence as a user, I have more and more epectation that I shouldn't have to sign up for a n other account if I have for example a hotmail or facebook account and if I site makes me then I may see that as a barrier to entry! Should we as developers of applications be supporting multiple authentication scenarios or can something like openID really be the webs single sign on?

Thoughts?
Could you put your ssl stuff on a different subdomain to prevent the browser from doing this?
Arc Wars
undersea cable cut creates problem
Probably also the busiest time for their clients too.

Long live S3.
Subdomains are also considered different origins. There are other ways around it, like using <script> tags.

As far as whether or not that would prevent falling back to non-SSL, I doubt it.
AANN project: Physical Neural Network
I don't know what you're talking about. I downloaded Arc and it immediately became sentient on my machine. It started writing it's own macros and evolving while I slept, and I'm pretty sure we all woke up this morning inside the Matrix.
Personally I'm a fan of OpenID. It's open, flexible, and probably the most widely adopted single sign-on system.

I would roll my own authentication, but also support OpenID, mostly because I think "average" users would be scared away by forcing them to sign up for an OpenID first. These guys (a summer '07 YC company) might help with that problem though... http://www.clickpass.com/

I don't think the Facebook authentication API is meant to be a general purpose login system, but rather only for authenticating for use with the other Facebook APIs, much like OAuth. And I wouldn't touch Windows Live ID / Passport...
I will admit I did not read the whole post. I've seen so many of these "reporters" do their little bits about Rule 240 that they all sort of blend together for me.'

Also, everyone should read http://dir.salon.com/topics/ask_the_pilot/
I have a degree in physical geography, but now work full-time on some sweet research projects.
Silly. Why would anyone think that people's behavior while doing research on the web would be any different from their interaction with a library card catalog?

Should we have concluded that people didn't have time to read because we observed them thumb through index cards, write things down and then scuttle over to a different drawer?
Funny, I came to the same conclusion, but by a much less scientific method: I found where "frug" was being written into the hash file. That led me to ensure-dir and ultimately to the mkdir problem, too.

His blog post and description is a lot more entertaining than what I would have written, though.
But if it can't make the connection to a non-SSL server on that domain then it can't send a cookie, I'd think. Unless it falls over to the non-subdomain.
How to Develop a Sense of Scale
Meebo Turns Chat Rooms Into A Web Service
Sweden indicts four from Pirate Bay
Fractions vs Decimals was a big debate in my 5th grade classroom. The teacher asked us, after showing us each way, which one we preferred. The class was split.

At the time, I thought the debate was just about convenience in hand calculations - a mistaken notion that seems to be at the core of the link. I didn't realize how conceptual fractions were until college, though, when I saw a proof in number theory that the square root of two can't be represented as the ratio of two integers.

It wasn't until real analysis that I started to understand why "natural" numbers like pi and euler's constant can't be represented through fractions (and why this is what you should expect), why factions can be counted but real numbers can't, and so forth.

Personally, I think kids need to learn fractions to get mentally ready for this sort of realization... but maybe that's just because that was my path toward understanding it. On a purely computational level... the symbolic reasoning needed for algebra and calculus (which isn't just math theory, but almost everything mathematical) is probably more related to mentally managing fractions than decimals (the quadratic equation, for example, uses the dividing line. A decimal representation wouldn't be useful here, would it?)

All in all, kids probably need to understand that most numbers can only be approximated with fractions and decimals.
From Earth to the edge of the visible universe - all on ONE map (large GIF)
Arc's not even an acceptable modern Lisp
PAIP; Lisp Lisp Lisp
Excellent point....
Bill Gates Macintosh Endorsement
Graph Theory by Diestel
"...we're going to keep acting as if we were the only users..."

The shortcut to excellence by avoiding the "lowest common denominator syndrome".
I know, I love Google products and use them extensively, but they all trail their competitors. Probably inertia where people won't change even though there's a much better, equally free alternative. I think it comes from Google seeing a useful online service and building their own better version. By the time Google's offering is up, users have already developed habits on other apps.

I guess rather than dysfunctional I meant "relatively unpopular". The fact that you don't know a single hotmail user is a reflection of the kind of people you know, because hotmail and yahoo mail have multiple times more users than gmail. Technical superiority doesn't always (or even usually) win. Heck, IE7 crashes on my wife a couple times a day and she still refuses to use Firefox (which is installed on her computer with a copy of her bookmarks).

By behind, I definitely mean in # of users, not technologically.
Here's a ridiculously long but very interesting article (well, basically a book) about undersea and overland telecom/network cables. Worth the read when you have [a lot of] time.

http://www.wired.com/wired/archive/4.12/ffglass.html
If the Google founders have agreed to work together for the next 20 years ( http://money.cnn.com/2008/01/18/news/companies/google.fortun... ) and 1/3 of the first 500 Google employees have left ( http://www.news.com/Life-after-Google%2C-with-millions/2100-... ) and 2200 Google employees vest and become millionaire this year and the share price has gone from US$700 to US$550 and falling then the founders could be last to switch off the lights.
I would find this kind of thing more interesting if they stuck to the technical stuff and left out the handwaving and ranting.
Even if the recording industry manages to shut down Pirate Bay in Sweden they will just move their servers elsewhere. They have already demonstrated that they are capable of doing this - last time they were raided by the police their servers were up and running in other countries within 24 hours.

And even if they manage to shut down the Pirate Bay completely something else will fill the gap within a month. Napster, Kazaa, e-mule, the list goes on...

Don't these people have anybody looking into new businees models? Their current one seems to revolve around suing their customers, and in the long term I somehow don't think that is a great strategy...

I don't necessarily agree that it is OK to steal copyrighted work, but seen from a business perspective they are digging their own grave. The world evolves, and industries that don't evolve with it will wither and eventually die.
I wonder if there wasn't some reluctance to use easy Scheme-provided functions? There are several places like this where Arc does something "the hard way" by using something already defined rather than importing another dependancy.
thoughts on startup dev teams
interesting thoughts
nuvifone: Garmin Drops a Phone into the GPS
This is a pretty not good argument. Like definition of bad.
The Team Behind Snarky Startup Blog Uncov Reveals Its Own Startup, Persai
The last paragraph is great advice for all software development, not just languages.

When you're writing software for larger company it's difficult to justify redesigning to create a simpler, more elegant codebase because it adds zero value (from a customer's perspective).

When you're working on your own project, it's possible and also eventually pays off, yielding more maintainable code.
Tried it out, quite useful. Looks like I'll be able to make good on my promise to never actually learn flash.
> (Did I miss any? ;-)

Yep, the Duke Nukem Forever rewrite is waiting for Arc.
A computer shop's sales pitch: 'We remove Vista'
Is multicore hype or reality?
given that uncov was basically a mean spirited version of techcrunch, I wonder if what goes around will come around (that is if persai ends up sucking)
Arc has been out for days and they're not done with it yet?!
Richard Stallman is the new Chuck Norris
Rebuilding your system from scratch once you become 'successful' sounds impossible.

You never are successful enough. As you grow, the system gets larger and harder to rewrite from scratch. From a business perspective it makes absolutely no sense to ditch what created your success.

It is idealistic, and would be great if it could work that way. However, it is a bit naive.
It's by Neal Stephenson which, I suppose, might augur well (Snow Crash) or ill (Quicksilver).
"From a less elementary perspective this means that Facebook, a website less than five years old, is now valued at as much money as Ford Motors."

http://finance.yahoo.com/q/ks?s=F

Ford's enterprise value (as opposed to the value of their stock) is about $150 billion. One of the reasons new companies look deceptively valuable is that they're capitalized mostly with equity. A large company like Ford or GE will borrow pretty extensively, and their stock will be a small fraction of their total value (though probably the best proxy for how well they create wealth).
How to hire a manager
you're just contributing to the time spent talking about Arc instead of coding. the kind of people who were going to get anything done, know how to ignore pointless discussion.
Company that has never made a phone before creates a gadget that could actually dethrone the iPhone
'Facebook fatigue' kicks in as people tire of social networks
GMail and Google Maps are definitely behind in # of users, but I would think that both are increasing market share at a faster rate than the existing players.
Helvetica v. Arial: Take the Test--Which is Which?
Alright, this is a great release after a long week.

I will add:

Lisp contains an ad hoc informally-specified bug-ridden slow implementation of half of RMS.
I keep thinking how we'll be the first generation who won't be able to get over our youthful indiscretions. They're all captured and archived online for posterity. 20 years from now it'll be pretty much a given than you can run a search and find bad goth poetry by your investment banker.
That seems fair enough, if I was doing Arc then I'd want to define as much as I could in Arc so that porting it would be easy (and also to prove the expressiveness of the 'simpler' parts of the language).

In this case you need access to date information and currently that's done by assuming that it's ok to (system) to GNU date. That's a big assumption. I think it would be fairly easy to wrap up the Scheme code into an Arc native definition.

For example, Arc defined seconds to be the current Unix epoch (which is does via Scheme's current-seconds). It would be pretty easy to do the same thing for month, day, year and make them primitive and then write date on top of them entirely in Arc.
One thing I think Arc does (or intends to do) right is to be as cruft-free as possible. That is one thing you need to get functional programming to the masses. If learning FP means also having to master dotted pairs, associative tables, 13 different object comparison procedures, cadaddadr, the LOOP syntax... then you can count "the masses" right out.

Add a good introductory book (the current tutorial looks good; I haven't finished it yet) and you may be onto something.
In memory of chicagocrime.org
Take this logic test
Has there been any apps released with Arc yet? (aside from news.ycombinator.com)
How will the cable in the Middle East affect the rest of the world?
I'm sure many of you know about the data cable that was damaged, resulting in a huge loss of bandwidth for the middle east, namely India.<p>My question for you is this: How will this effect the rest of the world? Will America see its economy suffer from the loss of outsourced tech-support? What about the entangled economies of the Middle East and the rest of the world? Could poor communication of oil companies that operate there suffer and ultimately raise oil prices? Tell me what you think.<p>Here is a site to get you started:
http://edition.cnn.com/2008/WORLD/meast/01/31/dubai.outage/?imw=Y&iref=mpstoryemail<p>Other articles are already on Hacker News.
That's been said before, but the current industry got fat off the way things were. You can bet they'll kick and scream before cutting off a pound of their own flesh - no matter how clear the need.
> How wrong is it to regard [Arc] as a new Morris worm that infects

> MzScheme installations with unhygienic macros and empty lists that

> serve as false?
I have to agree with you on that. I only use the captcha when I absolutely need to. What I've found to work well is have the mail go through a good spam filter before you get it.
Worth noting that the iPhone was also made by a company that had never made a phone before.

Kinda says something about the companies that do make phones.
That's actually a really good point, though Apple had made a handheld before, the Newton.
Yeah it has, the comment was not so much to try and say something new as it was amazement at how a whole industry can so stubborn be walking right into its grave.

It is just totally beyond comprehension.
It depends on your market really. If you target older people, less tech-savvy people, open if, favebook and live are probably bad choices. However, a younger less tech-savvy market would do great on a facebook.live platform. Right now I think openid is still too much tech oriented for the general public.
The shaven beard of Richard Stallman can be used to cure cancer. But RMS has never shaved, even once.
If your site has sensitive data like credit card information or the like, rolling your own auth is the only good way to protect yourself and users from an incident. With openid in particular you have no idea how secure the provider is, and users will blame you if their data's exposed because they don't know better.
I was wrestling with this too.

I implemented all of the SSOs: Live, Facebook, Yahoo (pre-oid), AOL (+ICQ/OpenAuth), plus OpenID, but then the sign in page is a disaster. I felt like it was just as hard for the user to remember which sign on service they had used the first time as to remember the username and password that they'd used. You also only get a GUID back from the SSO (for most of them), so you can't "help" other than by keeping them signed in via cookie for as long as possible.

So, then I went to just OpenID (since openid.yahoo.com), with a customized signup thing on myOpenID. But despite the best efforts of everyone, no one really cares about OpenID and "most users" don't have an OpenID, or if they do, they don't remember that they do. Of course, this depends on your target audience.

If you don't need any more information than username/password to get started then most people seem to be most comfortable with having a dumb [login(user/pass)] [register(user/pass1/pass2)]. They'll use one of the 2-3 other usernames they use in other places, and one of the 2-3 passwords they use everywhere else, and it'll suck, but they'll be logged in and you won't have lost a user to simple confusion.

So personally, I'm going with roll your own + a tiny little link to an OpenID sign in page.

Incidentally, Live is the best SSO user experience, imo (though a PITA to implement) if you felt like just picking one big one and going with it.
YouTubers given share of ad cash
Web disturbances set to continue
PS3: Glass half full or empty?
Facebook Fatigue - Are Apps Driving Users Away?
Maybe not. But unlike CL, Arc has a snowball's chance in hell of competing with Java.
Top Google execs pledged to stay 20 years
"You scored 15 (100%)"

That was fun. To many, logic is a lost art, sadly.

I almost missed #11 :-)

a) Men are from Mars.

b) Women are from Venus.

- Therefore men and women will never understand each other.

Here's my own:
Raises and promotions should be earned by high logic scores from this test.

I got a high score on this test.

Therefor, I should get a good raise and a promotion.
Generation Y: Tech-savvy grads with pushy parents
Sprint sees Nextel write-off of up to $31 billion
RMS doubles the exponential base in Moore's Law every two years.

edit: the one about the ad-hoc bug-ridden implementation of RMS wins.
Microsoft's open-source strategy
meebo Launches meebo rooms API and the meebo Network
What's the Deal with WiMAX?
I think that this completely misses the point of why the iphone is great.

When the iphone came out it was something that we had never seen before - it was sleek, had a great userinterface, large touchscreen and so on. That is why it was a success. It created its own niche that had not been filled before.

Now all sorts of companies come up with "iphone killers" and think that they can do better than apple. But the game is already over - the market has moved on. The iphone was cool because it was a genuine innovation. Whatever rip-off some company dreams up now will only be compared to the iphone, effectively establishing Apples brand as the innovative leader.

What you really need to do if you want to create an iphone killer is to think creatively and make your own innovative product. A copy-cat iphone will always be just that: a copy.
Microsoft Patents Office Spying System
"Bill Gates earned over $3000 per minute [$50/second] since Microsoft was created. Spending 5 seconds to pick $100 off the floor is literally not a good use of his time."
How does it take 5 seconds to pick a bill up off the floor? Also, most of his money was made via stock appreciation, so it's not as if he stops earning when he bends over to pick up a benjy.
KickApps Version 3.0 Released Today; New API Dev Kit Insid
The last capitalist we hack shall be the one who sold Richard Stallman the computer.
Ramping up for Bluetooth's second decade
Amazon buying Audible.com for $300M
For readers of Neal Stephenson's "Cryptonomicon," this news will bring some paranoid visions dancing into your head. My first thought was "I wonder if someone cut it on purpose?" Seems unlikely, but you have to wonder why they are so reticent about disclosing the cause.

Interesting news.
The choice of signon system depends on the type of site you have. I want my users to be able to sign up and use the service as quickly as possible.

Picking usernames can be a major source of frustration, my current thinking is the signup box should be just asking for email address and password, and roll from there. Quick and easy.

A few years ago Microsoft stopped allowing third-party sites to use Passport as a signin to their sites (except partners). Although they allow it again, I would take that as a strong warning not to rely on a third party for signin systems.

Facebook ask a lot of questions when signing up. If I didn't have a FB account, I would't be inclined to use your service if I had to tie it to a social network signin (unless your service was a facebook application).

OpenID is a massive disaster. I spent an entire day as a user reading up on it and trying to signup and use my ID on multiple sites. The whole thing is terribly complex and confusing. Every site implemented it badly. Do you want to support OpenID 1 or 2? Do your users care?

Last week I spoke to a developer on a massive site (a hugely popular new-generation audio site) and we agreed implementing an OpenID container is far from straightforward. You have to support many different things and some sites still throw errors when using OpenID Delegation (allow you to use your own domain to signin).

Unless you have a very good reason to, I'd suggest to keep far away from OpenID until they get their act together.

To recap, I want to register for a new site as quickly as possible. Just prompt for an email address and password and save yourself and your users a lot of hassle.
"When Richard Stallman makes a sudo command, he loses permissions."

oh man, this is better than bash
I wrote about this some time ago. Here is the link if interested: http://kirubakaran.blogspot.com/2007/08/comes-back-to-bite-y...
Quick thought on blindly copying Facebook features
What do Yahoo's monetization woes have to do with social networking sites?
I thought what I'd do was, I'd pretend I was one of those deaf-mutes.
agree - I've seen complete 'enterprise' re-writes of 'non-enterprise' projects at multiple large companies

All of the ones I've witnessed were big spectacular failures, especially since they didn't involve the 1st 'fired' team.