skysight-inc/HackerNews huggingface dataset:
That's very possibly the vector.

If you can place a .php file in the plugins directory located here: http://www.techcrunch.com/plugins/

And then if you call the script as per your example, then it appears that plugin is loaded (and evaluated).

Someone else more versed in PHP might want to cast their eyes over the wordpress plugin to see whether I'm right:
http://wordpress.org/extend/plugins/wp-super-cache/

But it appears it's a case of globals not being checked prior to use:
http://php.net/manual/en/security.globals.php

So at first glance and with limited info... it's a plugin. Not that this surprises me, I still use vBulletin and I spend a lot of time code-reading the plugins for that before I use them. Mostly to make sure they don't do silly things like have SQL inside a loop over potentially lots of items, but also for the obvious security holes.

register_globals is an old one though, should be disabled:
http://drupal.org/node/222343
How 'The Hidden Brain' Does The Thinking For Us
Exploring Dynamism in Programming Languages
PG,
Just how much of a minus would it be that both founders would have to return to college in the fall? Given they can reasonably continue to work in school.
Which is why you also posted it on your Twitter account?
Back in the day I was very penny-wise and pound-foolish -- it was practically my tagline. In some ways I still am. But I've learned about reimplementing stuff outside my core competencies.

It doesn't matter that $100 or whatever sounds like a lot of money to me, or that $100 can buy a lot of slices or software or pizza for that matter. What does matter is that setting up cacti/nagios/etc takes time. That is time where I could be doing things that actually make money, like fun SEO work or intellectual-stimulating-as-watching-paint-dry-but-sure-as-heck-profitable button A/B testing.

A single A/B test which offered a 3% lift anywhere pays for $100 a month, and for companies or individuals operating above my scale, you have even less of a bar to waltz over. I also typically don't have to maintain those (gif files break remarkably seldom in my experience compared to software), where getting more software running just increases the number of things that can need tweaking or go wrong next month.

Now, you're almost certainly a better sysadmin than I am, so maybe knocking together some cacti/nagios scripts is really, really fast for you. But I'm betting the best use of your time is probably more effective than doing this.
Not from here
I appreciate that whoever runs the site can call it whatever they like, but I wish they hadn't chosen 'Hacker News'. I know that it's my own prejudices at play here but it's simply embarrassing to have 'Hacker News' staring out from the top of my browser window. It's so ridiculous I can't even bring myself to say it, when I discuss links with a friend who also checks this site the conversation starts with 'did you see that article about X on the, er, the YCombinator news site?'.
After playing with the RC1 for a while at work I noticed that the live() methods with mouseenter and mouseleave are incredibly hungry processes and can easily max out a CPU by moving the mouse quickly and erratically. Changing this to a bind() method caused some CPU spike, but not enough to max out the browser like the live() method.

Mind you, this is purely anecdotal and I understand the fundemental differences in the methods (event bubbling versus binding), but it kind of shows that it should be employed cautiously when detecting mouse movement related events.
A Mathematician’s Lament by Paul Lockhart:
http://www.maa.org/devlin/LockhartsLament.pdf

Persuaded me that the way I learned math is pathologically soul crushing; the way it's taught from kindergarden through university. The first two pages set up a nice metaphor: mathematics is argument and creativity and our traditional math education by memorization and rote repetition are akin to teaching music by reading and writing sheet music without first hearing or playing an instrument.

"No society would ever reduce such a beautiful and
meaningful art form to something so mindless and trivial; no culture could be so cruel to its
children as to deprive them of such a natural, satisfying means of human expression."

The rest of the article digs into some specific examples.

Mathematics instruction needs an overhaul and back-to-basics isn't The Right Thing.
I think h.264 is a bit less evil than flash. First, it is not ubiquitous yet. Second, it turns the flash vs <video> fight into a <video h.264> vs <video Theora> fight. This move already lean towards open standards and free software. Pushing further can only mean the eventual victory of Theora.

Now, talking like Theora doesn't exist is evil. However, Apple and its fans don't have much choice: Apple is a licensor of some patents on h.264, and hardware acceleration isn't available for Theora in the Iphone. A world without Theora is in their best interests.

The eventual format will probably be determined by Google (with YouTube). Will they chose a non-encumbered format, or will they choose to support the Iphones ? I don't know.
feedbeater looks like it generates it fine--
e.g.

http://www.diffbot.com/api/rss/http://news.ycombinator.com/
After reading the chapter and glossing over Hill's paper, I think I can deny your suspicions.

Ted Hill's papers on Bedford's law are from 1995, and this chapter is from 1997. Wolfram's date is incorrect, although the secondary phenomona that choosing from a distribution which itself was chosen at random is log normal was proved at that later time.

The 'straw-man' was misunderstood by you. The author points out in the conclusion of that paragraph that all of these pseudo-scientific or grandiose explanations where nonsense.

The 'proof' is really an explanation that the phenomena presents itself to an easier analysis when viewed in terms of FTs. The computer program is there to show the reader the 'repeatedly divide by ten' action which is implicitly going on when we map from the unbounded domain to a small bounded domain.

Its a nice explanation really, but as the problem was solved years earlier and this analysis isn't given with another application, I can see why it wasn't accepted for publication in a pure math journal.
Just how many times in January is jQuery going to be released?
I'm not knocking WordPress, I've seen people do amazing things with. But for my needs it's not quite the right fit.
But the key thing here is that the project responds very quickly to the new feedback and releases an updated version. How many projects do that? Not many.

Serious kudos for creating such a responsive culture in the project.
Wanna know when someone has commented on your post?
(Blantant product plug ahead :-)

I recently posted a question on Hacker News about receiving online payments in the UK - I got a lot of really great answers - thanks everyone.

Because these answers are important to me, I didn't want to miss any valuable comments. Very simply, I created a Femtoo tracker pointing to this URL:

http://news.ycombinator.com/item?id=1074860

that monitors the small text "33 comments" text below the post title. Everytime a new comment was posted, I received an Instant Message telling me how many comments there are.

I think this may be really useful to other Hacker News readers... so please check out 'Femtoo.com' :-)

If you don't want to register - fine, you can still receive notifications of trackers that other people have 'published':

http://www.femtoo.com/index.php?action=TrackerLibraryLoad

thanks for you time.
Apple iPad Pricing and Availability: $600-$1000, March 1st?
Flash is a bad deal technically. It is the most straightforward solution for the kind of things you describe which cements its place for a while just by itself, but you should see some reasons for it to die.

It's a proprietary blob that Adobe controls. They can and have dropped support for non-conventional platforms in the past. You can't see what the Flash Player is doing. Adobe can at their leisure impose any kind of crazy restrictions on Flash content (because they control the Flash Player, which is required to watch Flash content, and its terms of distribution).

Flash is an ugly marr upon the otherwise open standards needed for a rich web experience, because its fate is completely controlled by Adobe's interests. Adobe has far too much ownership for the kind of reach Flash has, it is dangerous and should depart.

Flash Player itself is a behemoth and a hog. It spins up CPUs to full power without any need and in so doing causes heating issues, battery-life issues, and other bad things. It is inefficient and sad and not good. You should hope it dies so that you can actually watch full-screen video on non-Windows or non-x86 platforms at more than 15 FPS.

Flash is not like After Effects; AE sits on one side of the production process and its results play on regular cinema projectors, DVDs, and many other formats, including open, non-proprietary formats (anything that can save and playback video, including hard disks).

When you make something in Flash, you impose Flash Player upon all of its potential consumers (ignoring Gnash and others because they can't play very much). They have no choice but to allow the non-free Adobe blob on their machine if they want to consume your content. This is bad.

Flash is bad all around in the long-term. It's a convenient tool for designers to get the effects clients want, which is why it pervades so deeply, and I agree that Flash will stay in the game until a better tool emerges (HTML5 advocates, this means you should be working on an HTML5 IDE that will replace the Flash IDE and provide an easy transition path for current Flash users), but Flash is not a good thing. It needs to die.
It was earlier before techcrunch went down the second time.
I think it's bullshit and a big waste of money that the government is wasting money on overhauling ATC. Going to GPS and such definitely has its benefits but as any pilot or controller will tell you the problem isn't the routes it's the airports. Before you put an airplane in the sky you have to have a place for it to land. Gates and slots are so tight they are almost inflexible. This creates a network effect of delays in one airport cascades to others. Planes that are late can't be cleaned and boarded so it pushes other planes waiting for the gate to also be delayed.

What needs to be abandoned is the hub-spoke airport system. It had it's place in the 80s when computers weren't very powerful but algorithms and processors have improved and route optimizations would be so much better.
Drupal is such a complex pig, a custom solution would be much better. Especially for someone as big as TechCrunch.
That's a surprisingly open approach from a governmental agency. Most similar efforts seem half-hearted at best. I wonder what makes them different.
I'm always surprised when new APIs are released using XML. JSON is easier to produce and consume, so why's it taking so long to become standard?
Jekyll - Superset of C with lambdas, type classes...
Don't see how this conflicts with the author's point. The author stated, "Giving an Easy Mode to the people who need or want it has no effect on the play experience of those who don't use it."

However, in your example, they made Halo 3's hard mode easier. That's not the situation the author was referencing.
I have a slightly off-topic question: What is a simple (and legal) way to monetize a high pagerank website? The article mentions that it is very difficult to reach to PR 6, yet I found that my personal page has PR 6, without having consciously tried to optimize it. I am honestly wondering if there is any way to benefit from that or I should just be happy that my page comes up on google before those with the same name like me.
I didn't set any prefix or suffix and instead just selected all the radio buttons. Now I get it, but at first I was confused why no results are coming up.
Marina Orlova is Definitely Hot For Words
Apple Tackling a New Market?
"... for someone as big as TechCrunch"

Huh? How does "big" make them deserve a custom solution? Huge behemoths like nowPublic.com and spreadfirefox.com run Drupal. Heck, economist.com is >>> techcrunch, and they're dropping their custom solution and shifting to Drupal. IMO, "big" is the least of their concerns if they want to switch to Drupal. TC is perfect example of a website wanting content management. Content is what they deal with.

But, I will say Drupal is not the answer to all problems. For example: if your application deals primarily with data that can't be classified broadly into "content". Like last.fm or chesspark.com or etherpad.com... you get me.
Demonoid Bittorrent Site Is Now Open To All
It seems to fit the facts - what is an alternative explanation that fits the facts? That they just don't notice?
Because XML is enterprise.
the article assumes that the x to close the toolbar is part of the toolbar itself.

it's not.

the x is a new feature of IE 8 and it is used to make IE not load the plugin responsible for drawing that toolbar.

So when you press the X, the toolbar isn't loaded next time you start IE, but isn't notified of this either.

The enhanced reporting features are part of the Google Toolbar BOH (browser helper object) which is not disabled when you click that X. The reason for that is the fact that IE as host of these plugins can't be 100% sure that the BOH and the toolbar are related.

Earlier versions of IE didn't have the X so there was just one way to turn the toolbar and/or reporting off: To use the methods provided by the toolbar itself (using the uninstaller or to disable the enhanced reporting using the toolbars official UI).

This current situation, IMHO, is just a consequence of the toolbar not being updated to the new situation (i.e. the x being drawn by IE).

Based on the technical knowledge I would not jump ahead and assume malice (on this part at least - the crappy taskbar button is another issue).

The irony behind this is the fact that IE added the x as a usability enhancement to deal with the growing amount of auto-installed toolbars and now they created a real mess due to not correctly track dependencies between different plugins.
How about an Aussie-targeted site for finding drinking buddies? :-P
Wireless Versus Wired Versus Network Over Mains
Methods For Researching Information
Hive at Facebook
The practical upshot of this is that if you really want an answer of if you really want to discuss a subject and you think that it is not mainstream enough to catch a couple of upvotes in the first half hour you can more than double your chances by posting it elsewhere and then submitting the link

This has always been the recommended approach by pg.
TechCrunched - TechCrunch the Victim of a Defacement
This is a direct violation of the freedoms of Free Software and section 5 of opensource definition: “5. No Discrimination Against Persons or Groups”.
What exactly does your bingo startup do again? ;)

I finally broke down recently and made a compendium of all my username/passwords combinations in an encrypted file. It was eye opening when I finally saw how many passwords I actually use and (mostly) remember. The repetition frequency was higher than I would like, but I'm careful to never use the same password for a site account and the associated email address(es). Unfortunately, I can't say the same for my relatives and friends...
whoever wins I guess
A lot of WP sites that get exploited have been due to the FTP password jacking / iframe exploit. Typically WP is quite reliable with fast patches preventing catastrophe.
В Контакте | Мои группы
More likely it was an automated attack carried out by bots. I'm still putting my money on the recent rash of non-secure FTP exploits (client side).
Yes, I mean something else. :) When "--close-branch"-ing or merging back to "default" are closed and hidden in the branch list, but still present in the revision tree, and you get warnings if you try to create a new branch later with the same name. In Git they are just gone, as if they were never created. (Note that you have plenty of opportunity to restore them before garbage collection if you deleted one by accident.)
As of now, TC is back. There is no mention of what went wrong though.
Why would a significant portion of jQuery users want to be unpaid QA testers? It surely is a noble cause and is great for the community at large, but it's naive to expect that more than a tiny minority will actually contribute when they can just sit back and reap the rewards. ;)
Actually, I have now enabled the search indexes for the following prefix+suffix combinations: 4+1, 3+2, 3+1, 2+1, 2+2, 1+1, 1+2, 1+3, 2+3, 1+4. I may add longer combinations later, but for now they will be shortened and filtered, e.g. 5+3 will use cached 4+1 and then filter the results in the browser with JavaScript.
I wonder if it isn't a waste of energy to integrate with 10 different providers and to keep up with all API changes and being forced to find the best way to abstract all the different features of the providers into one interface...
Because it's a search engine for short names, using a large database of unused and expired domain names. Try searching for "hack" + "ne", or "hack" + "e" for even more results.
It is if you're having to do it for your own stuff, but if someone else is making it their job, that's a valuable service so long as it gets you out of being locked into vendors cloud solutions.

If they are charging on an annual basis less than it would cost to switch your codebase between any one set of providers, then you're getting a deal.
Apologies, have changed the submission title back to the original article's headline.
How hard can it be to measure phishing?
Malay Rural Experience
Yes, that was the previous version that I announced here on January 1st. I figured that usability is more important than fine-grained control over the score weights, because the sort order is not terribly critical. Basically, the user should be able to adjust the trade-off between short and popular names. But it's a brainstorming tool, we're not trying to get one particular name to the very top of the list.
Any tips on promoting an iPhone app?
I created a simple little app just to test the app store waters. The app let's you relive the famous Will Ferell/Christopher Walken SNL skit (More Cowbell).

The concept was simple and took like 2-3 hours to code. I submitted to the app store and it got in within 2-3 days. Now I'm wondering if you guys have any ideas for how to market or spread this thing. I was thinking about maybe making a funny video with kids from my dorm playing with it but don't really have any ideas past that. I don't have any real experience with this field and would love to learn more.

It could just be that this just doesn't give me any ROI ... but I figure the investment was around 3-4 hrs of work and I should be able to sell at least a couple copies

Here's a link to the app if you're interested:
http://www.muonmobile.com

The key cool feature is that I recomposed and synthesized pieces of the original song and you can actually cowbell along to it... so I'm hoping that maybe makes this app a little better
Flickr as a Business Simulator
Well it might be more useful for your argument if you discussed particular instances where wikileaks has published material that you consider hidden legitimately.
Simple trick: come up with "random" numbers, from your own head. Make a list of them. They're not random, but part of the charm here is noticing that even you're affected by Benford's Law.

Now, pair them off, in order, and write down the products: you'll notice a large amount start with 1!

(of course you'll actively avoid this if you're expecting it)
A large part of the developers I know (ie met physically) are not even aware of what JSON is (although it definitely contrasts with the web/ruby/python/javascript world).

Another point is that API to parse XML are built-in (and widely known) in almost all platforms, whereas JSON requires external libraries on some (I believe .Net, Java for instance).
Edit: Ah, there you have it. Statement from Media Markt: The Twitter account is no official Media Markt account, the tweet is completely fake. The amount of research those rumor "joournalists" do is reeeeeeeally impressive. (Source, sorry German: http://www.fscklog.com/2010/01/media-markt-twittert-ipad-hum...)

Incredibly stupid rumor.

Why would Media Markt have any clue about upcoming Apple products? Do you think Best Buy knows what's coming? Even if you do, do you think the people in PR or Marketing who write those tweets know any of those people in the company who know?

Probably a bored intern.

(I honestly have huge doubts whether Apple Germany knows what's coming.)
All it takes is one enlightened person who is persistent enough.
Factor has very little in common with Forth, besides having a stack based concatenative syntax based off Forths. It has often been said within the Factor community that Factor has much much more in common with Lisp than it does with Forth.
They had register_globals on? @_@

I hope they go for the radical openness option and do a full public post-mortem. A teachable moment like this should not be wasted.

register_globals was known to be a bad idea in 1999 for crying out loud.
I'm assuming that there's a set of functions for shooting innocent but rowdy civilians in the back, while they're handcuffed and on the ground face-down?
Massive budget deficits, gross mis-management, fraud, MURDER, etc have all come together to ruin BART's reputation and make them an embarrassment to California government. This is just another attempt at fixing their ruined image until the next scandal.
I think that's exactly it - XML integration, serialization to XML tends to be built-in to many existing environments. If the BART site is any clue, they are using ASPX/.NET.

The XML they are using is also very straightforward, elements-only, no attributes, namespaces, SOAP, other weirdness. It doesn't look any harder or easier to produce and consume than JSON. For part of their previous offering they are using a Google-designed format called GTFS which seems to be essentially well-defined CSV.
"Everything you write makes sense, but only in a world where music prices aren't set by psychotic rights owners"

Ouch. That's really unfair. Those sorts of prices are demanded by independents as well, including unsigned artists — look at indie artists on iTunes for example. The psychotic rights owners you describe are artists themselves and surely they have a right to price works as they choose? Just as punters have a right not to buy if they think it's too expensive.

"This is why major label mp3s cost $0.79-$1.29 just about everywhere."

Or you could just as easily argue that this is market forces at work. That's the price people are willing to pay, so that's how it's priced. These sorts of prices apply to many different releases, on both major and indie labels.

"When you have that baseline which you can't control, profiting from a discounted mp3 album isn't really possible."

I don't understand what you mean by baseline. As for the second half of the statement; plenty of digital retailers offer discounted releases and I hardly think they'd be doing that if rights holders weren't making money. Have a look at 7digital for example. Lots of majors, plenty of discounted releases.

"Costs of distribution are lower, but they exist. Your profits can quickly become costs unless you stay at the standard pricing levels."

To reiterate my basic argument; once production and marketing costs are recouped, margins are much higher, making discounting viable. The costs that you refer to would be a proportion of the sale given to the retailer. So if you want to make money, discount it, but not so far that it kills your profit margin. Imagine a 30/70 split your way. You might decide to discount a release so your split is smaller. _You can still make a profit_.
There's a radiolab show (called "Numbers") where they talk about this. Quite cool, though they don't go in to the reason behind it, which is a little unsatisfying.
That would be really nice. Please do.