skysight-inc/HackerNews huggingface dataset:
Please excuse me if this comes across as anything other than constructive criticism, but I don't believe checklists should be used to guide web developers to build secure software.

My reason for this belief is that, in my experience, it engenders tunnel vision and what I appropriately refer to as a "checklist mentality". There are developers who believe, "We're immune to the items on the OWASP Top 10, so we're secure," when there are entire classes of vulnerabilities that applications can be vulnerable to (say: using a weak and predictable PRNG for their password reset tokens) that isn't adequately described by the OWASP Top 10.

An alternative approach that I feel is more helpful is to organize insecurity into a taxonomy.

* Code/data confusion
* SQL Injection
* Local/Remote File Inclusion
* Cross-Site Scripting (XSS)
* LDAP Injection
* XPath Injection
* Several memory corruption vulnerabilities
* Logic Errors
* Confused deputies
* CSRF
* Failure to enforce access controls
* Operating Environment
* Using software with known vulnerabilities
* Using HTTP instead of HTTPS
* Cryptography flaws
* Yes, this deserves a category of its own
* Chosen-plaintext attacks
* Chosen-ciphertext attacks
* Side-channel cryptanalysis
* Hash collision vulnerabilities (e.g. length-extension)
* Weak/predictable random values

You can further break down into more specific instances.

There are three types of XSS (stored, reflective, DOM-based). There are blind SQL injection techniques worth studying too. But the underlying problem that makes these vulnerabilities possible is simple: User-provided data is being treated as code. Any technology that prevents this confusion will greatly improve security.

For example: SQL injection is neutered by using prepared statements. You might one day forget to manually escape a single input (and it only takes one to be game over), but if user data is always passed separately from the query string (i.e. you never concatenate), there's no opportunity to make this mistake. There were also corner-case escaping bypass attacks (usually involving Unicode) that you might not be vulnerable to. With prepared statements, these clever multibyte character tricks accomplish nothing. The query string is already in the database server before your user's parameters are sent.

I believe teaching developers to think in terms of taxonomy (very general to very specific) will result in a greater understanding of software security and reduce the incidence of vulnerable code.

I've written about this before, in case anyone wants to link to something besides an HN comment: https://paragonie.com/blog/2015/08/gentle-introduction-appli...

---

EDIT: Opened an issue: https://github.com/FallibleInc/security-guide-for-developers...
It doesn't need to, because the general population is already overflowing with asshats. Keeping a forum civil is a matter of keeping the local asshat population artificially low, not preventing it from growing artificially high.
"How difficult is it to find a job? How about a visa?"

If you have a degree and 2 years' post-degree work experience, your employer will have no problem sponsoring your work permit and visa. The process requires multiple steps and is often outsourced, so not every company will be willing to do it. But if they have at least one foreign employee then that's a good sign.

I'm assuming that you don't speak Chinese. For some jobs, this is a show-stopper or major disadvantage. There are other developers just as good as you, but who can read/write/speak/listen to communicate. BUT for software development jobs with many foreign companies (large ones like Amazon, or small game studios) you'll be on a level playing field with someone who speaks Chinese.

"Is there xenophobia? Are Americans looked down upon or treated differently?"

Americans are not looked down upon at all. Most Chinese I've met have respect for America's achievements and are aware of generally higher living standards there. Many white male Americans find more dating options in China than they did back home. (I'm neither white nor American, so have only heard this second hand.)
Based on my own experience viewing CV's. 5 seconds is quite a lot. Any CV I've gotten gives a first impression based on formatting, and I tend to dismiss people applying for a developer position that don't realise that maybe 12 different styles and colours mixed together randomly is a bit much.

It made me realise why so many HR agencies request the person's CV only to take the information and reformat it into the agencies style (which is generally boring, but sensible).

Don't get me wrong. I love unique CV's, but given the choice between 'unique' and 'useful' there's only one possible answer.
USOC sends letter warning non-Olympic sponsor companies
Exact link to the speech video recording: http://www.youtube.com/watch?v=r_lpyG-ddec&t=37m19s
I believe that the heavy use of iterators in LLVM was a mistake. The ownership mechanics has never not been a source of extreme confusion and annoying bugs. But, it's still a great backend.
Facebook scraps another Snapchat clone: 24-hour “Quick Updates”
"Wow DMCA sucks, has anyone around here circumvented any technical measures for copyright protection? Tell me about it!" - Not_A_DMCA
May not survive, but it's really their application that's patented. You can patent inventions and processes (how software patents came into being, and also how someone patented a "method for exercising cats" - a laser pointer mounted to a platform that moved it randomly).
Yes, there is a Zen state of C++ programming wherein you, the programmer, surrender to the wisdom of the compiler, and in doing so are liberated from caring about the minutiae of the type system, to be carried forth, skyward, on the twin winds of inference and overload resolution. I do enjoy that. RTTI is nothing like this – it’s a red herring, neither elegant nor powerful… at best it’s a misnomer (it’s more like RTT total lack of I, amirite) and at worst a distraction.

I dislike exceptions too, but in a difference-of-opinion way where I can be like “OK, that otherwise legible and reasonable code uses exceptions, unlike mine” and it doesn’t make me grimace like I involuntarily do for RTTI… I’d love to be mistaken tho, anyone with an inspiring counterexample, do share.
Being schizophrenic does not mean that the brain/mind is "AWOL". Schizophrenics endure experience like the rest of us. The idea that the insane have "no mind" is an old-fashioned, dehumanizing idea which should not be tolerated even on HN where everyone is of course young, healthy and overconfident. (!)
I'm not sure if they bent the rules to be nice to him, or bent the rules because bribe money is shared between all parties involved.
I would assume ssh and its underlying logic are welcome here. What I assume is unwelcome is advocating religious tests in a secular state.
Those homes have yards, porches, and trees in the back (check the overhead view), and often rooms on the same floor as the garage (which is one car wide). This set-up is clearly not ideal but it's more efficient than the large unused front lawns present in most US suburbs.
Anyone who has tried it in a real app before? Any experience tips?
Upwork wordpress test answer 2016 (July)
Basic censorship. SV liberal-types are triggered by the word "Republican" and thus have filters for it. This response will be auto downvoted or filtered out soon.
People's version of cold varies. It's pretty funny though. I was in South Carolina in Novemebr a few years ago and people were wearing down jackets and wool hats -- it was 55!
"Learning basic Chinese is helpful, but in the biggest cities you can typically get by with English and gestures."

Sure, you can 'get by' in the sense that you'll be able to buy food and get around. But if you plan to spend more than 6 months in China, studying Chinese will pay off in a better overall experience.
Add this to the github repo. It's more useful feedback this way. https://github.com/FallibleInc/security-guide-for-developers...
It's of course fine to suggest the current system could be improved.

But it doesn't rise to the level of the title "how to fix flying". The current system, for all of its warts, has proven to be amazingly safe.
> Our nuclear bases still use floppy disks.
An odd thing to complain about. If it works, it works.
It depends on the protocol. Unobfuscated OpenVPN definitely behaves in the way you describe. But I very rarely have problems with PPTP, which is unobfuscated.
great speech.

3 most important reasons to keep hillary out of the white house;

stop the wars

hillary is bought off by goldman sachs.

massive bubbles in government bonds must STOP and interest rates MUST rise ( audit the fed)

side point he made, hillary uses divide and conquer political correctness to distract from the above three points.

this came from a gay man, who announced his gay identity to a huge crowd of republicans in ohio. so that critique of political correctness carried water.

as a thiel style libertarian myself, i would vote trump.
a vote for gary johnson is a vote for hillary.
Yes you are right, this sector is full of scam artists. See here http://www.abc.net.au/radionational/programs/backgroundbrief...

My father who is in the age group now pretty much confirmed all of this when recently shopping for one. As it was covered by his health care they were trying to flog him one at a ridiculous price.
Most of my friends don't live near me. I stay updated on their lives via Facebook. What's so sad about that?
I thought this line in the checklist was rather interesting:

> Check for no/default passwords for databases especially MongoDB & Redis. BTW MongoDB sucks, avoid it.
The Last VCRs Ever Will Be Made This Month
"Infinite deminsional gender space"
hsbc stock price seems to have bottomed out for a while. it is as very low prices compared to its current dividend. yielding over 7%
Could this be because as you go, you introduce more dimensions, degrees of freedom into your mental model. To accommodate for this, the brain needs to make room, and time and time again needs to reshuffle to make space for more connections or to eventually collapse them into multiple different models of a lesser degree.

I just read that second order logic can represent all higher order logics. The degree of the logic means the degree of nesting of sets into sets, that are quantified over by the logic expression. If sets of sets of values are all it takes, a two dimensional spatial representation should be enough. So far so good?

The problem with text is that it is largely sequential, i.e. one dimension, left to right.

> I am a practising computational scientist

only practice makes perfect (notice the 2nd C ;-)
His basic point is that even though the facts of this case look bad, at the end of the day even normal FX execution will like front running just because of the structure of the market.
> It seems then no coincidence that in physics and math we often consider partial sums as approximations, and concentrate on particular terms seperately. In physics for example, people think of "order \alpha^2 terms" or "higher order corrections" or physical quantities which are often taylor series cut off at some order, of course, assuming the quantity.

There are very good reasons for this. The whole observation is basically the same phenomenon as someone observing, "you know, 34,825,119,276 and 35,174,884,395 are basically the same number for my purposes; I'll just call it 3e10 or, if I'm being really fancy, 3.5e10".

In these applications, the series variable is a very small number. The higher exponents given to it in later terms of a taylor series cause those terms to be very small compared to the early terms. That's why we take the early terms as an approximation to the whole thing -- we have chosen our representation so that that will be true.

(This is the entire reason for Taylor series in the first place -- a Taylor series is a Maclaurin series adjusted so that the variable can be small for purposes of the series, no matter what its absolute value might be.)
But not opt-in for the friends of those who have already opted in.
This entire cause is a sham, beyond belief, a cause that seeks to degrade the value of creative thought and intellectual property.

Before we get into socioeconomic barrier discussions I am a former disabled homeless person who is how the founder of one of the most powerful environmental activism groups in the country. I started out with nothing and worked myself to where I am, using original and creative thought and at no time have I ever needed anyone’s intellectual property to build myself to where I am.

The Electronic Frontier Foundation, that supports this complete bullshit erosion of the rights of content creators everywhere, does nothing in this world but fight for causes that continually reduce the market value of original ideas.

They claim to fight for things like “free speech” but what they really fight for is the rights of anonymous hate groups to steal your photos and write nasty messages on them. They fight for the rights of the meek to inherit the Earth so they can then destroy it with their abject failures.

Look to the recent lawsuit Google v Oracle, where Oracle sued Google over the use of their software in Android. Google avoided billions in liability and it was all thanks to the work of the EFF, who suck off the teat of Silicon Valley and protect their billionaire buddies from financial liability, and then they support “little guys” like this so they can continue their 1% supporting ruse.

I look forward to watching this mad grab at free intellectual property get slapped down by Washington DC. This is not about fighting the government, this guy is a puppet being used by the power that be in Silicon Valley in order to allow companies like Google to continue to rob, loot, and pillage other people’s intellectual property without financial liability.
Previous discussion on HN: https://news.ycombinator.com/item?id=11772966
I'm extremely disappointed that my fellow engineers and technology entrepreneurs think this.
Everyone communicates in language, but not all language is made out of words and symbols written linearly on paper.
If you want your comments to be taken seriously, then maybe you should stop posting like this is /pol/. Go back to your containment board hugbox.
I guess Thiel really, really wants those tax breaks and laissez faire capitalism.
Thanks, appreciate your comment.
Heres to hoping this theory is true: http://www.inc.com/jeff-bercovici/peter-thiel-donald-trump-c...
We'll build a wall to keep the liberal types out of silicon valley! And they're going to pay for it!
A list of problems and not a single proposed solution. More of the same. The Iraq or Libya intervention already happened. So being against it then says nothing about it now. Will Trump discontinue operations in Syria? You get my point.
It works, but it's very fragile. A lot of our military tech is fragile. We have many dependencies on systems that are no longer (physically) produced outside DoD demand, which puts the prices into the exorbitant range.

Modernization efforts are error-prone and only bandaids in many cases.

And new efforts have seen production and development issues that are just embarrassing (F-35).
IBM is pushing hyperledger / blockchain on Power8 pretty hard.

Given how much memory bandwidth is a bottleneck on updating the internal Merkle trees, Power8 might be good for tx throughput
> Online, just as people with good intentions can find each other, people with bad ones can find each other and band together.

Yup. Besides egregious asshats, it has greatly helped conspiracy theorists to get together, fringe religious groups to get together, and fringe political groups to get together.

> In other words, the unmoderated Internet is an amplification device for small groups of people who might otherwise not get a voice, and it doesn't actually matter what they're saying.

I think that the amplification effect does vary, though, among different groups. Some groups already had worked out good ways to communicate before the internet, and to spread information. It wasn't as fast or as convenient as the internet, so things were slower than they are now, but it got the job done.

An example of such a group would be those in STEM fields. We had big libraries of technical material extensively cataloged and indexed and cross referenced, an extensive system of mailed bulletins and journals to keep us informed of new developments in our fields. We had telephones for long distance real time person to person discussion, and the postal system for less urgent communication or for sending documents and photographs.

The internet was a huge increase in the access to and speed of sending information for STEM people, but in some sense it was just a change in efficiency, not a fundamental change in what we could accomplish. I've compared it before to the printing press. We had books before the printing press, but it took a long time to make copies and they were expensive. The printing press made it faster and cheaper to make copies.

For those groups that were not organized like this, which includes the random asshats, the conspiracy theorists, and so on, the internet was a fundamental change. For them it like the discovery of fire or the development of agriculture. It put them in a whole new world.
This speech, distilled: New Deal good, wars in the Middle East bad, LGBT rights for all. It's not clear to me how this is an endorsement of Trump or the Republican party.
> When I was a kid, the great debate was about how to defeat the Soviet Union. And we won. Now we are told that the great debate is about who gets to use which bathroom.

> This is a distraction from our real problems. Who cares?

I guess in the 1950s and 60s all those people complaining they couldn't use the bathroom they wanted were just distracting from the real issue of the Commies.

This is just such a baffling, nonsensical statement that I can only conclude Thiel is pursuing some kind of hidden agenda and this is all part of a massive con.

Firstly, history shows us that who uses which bathroom is actually quite important. We used to have bathrooms with "Whites Only" written on them. We don't any more.

Secondly, Thiel has a JD, so presumably knows that this issue is a fairly significant constitutional one, and a lot more nuanced than he lets on.

Thirdly, the only people raising this debate are Republicans in right-wing areas. Nobody in Silicon Valley is debating this issue. Nobody. Who does Thiel think is "telling" us this is the "great debate"? It's just pandering, plain and simple.
Just use the connecting edge: 2(/)3 = 8, 2(-)8 = 3, 3(\)8 = 2.
I do wish that was brought up. However, government provided healthcare or not (and Medicare or not), I think healthcare should be closely regulated (maybe by professional organizations if not the government). I can't find the citation, but I was reading that as doctor density increases, the number of procedures increase even though the outcomes are the same. It's also pretty obvious that as Baby Boomers start retiring, we're going to need more medical professionals. The demand for those services probably won't show up until it's too late to train them so it'd be good to incentivise people now (although, it might be too late already).
That's all very interesting, and I totally agree that when you're extracting a resource faster than it's being created, you need to somehow account for the fact that the available quantity is finite.

But I don't see why looking at the energy used to create the resource, or the cost of creating it from scratch, is useful. All that matters today is what's there and how much we use. For example, consider oil versus uranium. In terms of usable energy content, there's a lot more uranium than oil on the planet. I haven't run the numbers, but I'm guessing that stellar nucleosynthesis of heavy elements like uranium is way less efficient than turning CHON into oil with photosynthesis and time. Certainly, if we were creating this stuff today, it would be way cheaper to create a megajoule of oil than a megajoule of U235. But, who cares? We have more uranium, so it ought to be cheaper per megajoule, all else being equal (which it very much isn't, of course).

You say that we're consuming about five million years of fossil fuel production per year, and that there's about 200-300 million years total. The rate is basically ignorable compared to usage, so what really matters is reserves divided by consumption rate. The relevant number is 40-50 years of reserves at current rates. For example, say it turns out that the geologists and petrochemists got it wrong, oil is actually much more energy intensive to produce naturally, and current reserves actually represent 400-600 million years of accumulation. The energetic cost accounting changes dramatically; each barrel of oil now represents twice as much input energy! But our economic situation today doesn't change one bit.

Taking your inheritance analogy, it doesn't matter how much money your rich family line started with, all that matters is how much is there now. It doesn't make a bit of difference to your spending whether your $10 million inheritance is the paltry remains of a $10 billion fortune, or the amazing end result of a $10 investment.

The whole business of input energy and cost to recreate just seems so very arbitrary. For example, why are you counting the cost of the oil, but not the cost of the oxygen you use to burn it? Both parts are necessary, and the fact that oxygen is ubiquitous and easy to access just makes it even more of a subsidy. Shouldn't we be counting not only all the fossil energy needed to create the oil we burn, but all the fossil energy needed to crack all that oxygen out of CO2?
Your description of "intellectually honest" is actually intellectually dishonest.

In the United States, we generally understand the right to political autonomy, and the right to vote in particular, to come from a citizen's existence as a citizen (which itself is derived from Enlightenment principles of inalienable human rights). There are nearly no philosophical exceptions to this and only a few pragmatic ones (e.g. age of majority).

The question of women's suffrage is by itself a reasonable litmus test of whether someone is politically sensible and, by this measure, Mr. Thiel can be judged insensible.

To judge Mr. Thiel as politically insensible on the basis of his opposition to women's suffrage is by definition intellectual honesty. Given the long history of philosophical, political, and jurisprudential consensus that produced the 19th Amendment, it is in fact intellectually dishonest to entertain the possibility that Mr. Thiel has a novel set of arguments that could justify the disenfranchisement of women as a class.

People are justified in being skeptical of Thiel based on his radical assertion that women's suffrage is a mistake and they are behaving sensibly when they express wariness about other claims he might make based on his established predilection for asserting dangerous claims against the political autonomy of others.

EDIT: grammar, readability.
Reading this gave me cancer.
Why are you hoping it's true? Either, like Thiel you also want democracy weakened. Or possibly you want Thiel to be revealed as the Thief he is. My hope is the latter.
I didn't flag the original. The problem is, this board is generally (political) flamewar free. And many of us want to keep it that way. To that end, partisan politics has no good place here. Policy discussions, even more to the philosophical "capitalism" vs "socialism" side are better than Republican vs Democrat.
Tesla's stock falls after Elon Musk reveals his 'master plan'
> I don't pretend to agree with every plank in our party's platform

Pretends that party agrees with everything he's saying.