skysight-inc/HackerNews huggingface dataset:
Thanks, I was wondering why they had XSS bugs. Surely the point of using a framework is so that you don't have to think (too hard) about that sort of low level security issue?
Happy to hear you see that, we are trying every day to pivot where we need to... it's hard... it's a big company but these posts remind me we have definitely made movement... thanks.
Yes, Google forces OEM to include some of their apps and use some of their service components to carry the Android name. It's an outrage. Not at all open like Apple's dealings with their OE-er, wait

Gruber is definitely consigned to the killfile now - this is the most blindly partisan waste of bytes I've seen yet. We'd all do well to stop pouring so much collective time and energy into divisive, navel-gazing bullshit like this - and the cyclic exchanges that they inevitably spawn.
Yep you're right. I'm using Geonames' free postal code search, and unfortunately I went over the quota around midday today, so searches stopped working after that point.

I'm going to look into purchasing their paid service, but in the meantime I modified the code to only accept zipcodes and bypass the geonames web service call.
I should. :) That's what I should be doing rather than worrying about Diaspora, anyway...
You'd think. Rails 3 is supposed to handle this, Haml has that setting I enabled...
Thank you for the feedback.

The search functionality makes a call out to Geonames.org to get location data, and unfortunately I hit the quota for more free account. I'm going to purchase premium service with a higher quota, but in the meantime I modified the search to only accept zipcodes, which will not require a call to geonames.
Author of article is blatantly a HN reader. Dan Goodin: identify yourself! :-)
The problem with stuff like this is, I'm not going to look at it. This story came about in part because Coda Hale (another security pro) posted a message to Twitter, linking to the crypto code in Diaspora with an abstract "uh oh". It was warranted, I posted a message to that effect, and got an inquiry, which was more properly addressed by Patrick, who has just provided Diaspora with several thousand dollars of free consulting.

What was the problem I was getting at? Oh, yeah: Diaspora has no apparent access to the software security expertise they need to pull this off. I looked at it for 17 seconds, rolled my eyes, and stopped reading. Maybe someone at iSec Partners will take this project under their wings. But why? Most software security professionals are up to their ears in interesting projects that aren't attempts by college kids to take on Facebook.

More than a few of those professionals are now busy working for Facebook.

This is a dumb idea for a project.
Maybe I'm just too European. But everybody deserves a day off once a week.

Developers (anyone really) that are too tired to think are useless to a company. Let people get their rest and their time spent working will be much more productive.

Isn't there a book about this? Myth of the man month or something like that?
I think it's easy to underestimate how valuable something like a Facebook account actually is.

If I meant someone real harm and had access to their Facebook account, I could cause them a lot of trouble. I could send messages to their friends asking for unreasonable favours, starting arguments or causing other offence, I could embarrass them in front of their family. I could stalk them in real life. Look what happened when 4chan got hold of the passwords to a bunch of Christian student Facebook accounts:

http://thenextweb.com/2009/08/22/4chan-launches-attack-chris...

Your online reputation is valuable.
Very disappointing especially with $200k behind them to do this properly and so many hopeful supporters.

As we predicted this is just another propitiatory system with open source code. Sort of like OpenID.Clever PR but not really what it claims to be.

How do you justify using the 'open' when it is based upon a propitiatory naming system? With Diaspora, whoever owns trydiaspora.com (anyone know who does?) owns your content and connections, meaning you are effectively trusting someone who is hiding their identity. Nice.

We try repeatedly to reach out to the Diaspora team when they kicked-off with an alternative that is 100% open and user-centric called NetID (see http://ucentric.org) but were ignored.

I guess that when you have $200,000 and no one to answer to, you can pretty much ignore your stated goals and anyone trying to help you achieve them.It also looks like that is basically what they are delivering for the $200k they raised as their blog suggests it is now an open project for the community to finish off...

As a side issue, is there any truth in the rumor that Zuckerberg gave them $100K?
So, they decided to shut down after only two months, and if I understand correctly, during the first month (May) one of the co-founders was almost completely in absentia, according to http://www.poynter.org/column.asp?id=45&aid=185999 ?
Shoot first, ask questions later.
If you're talking about your average glass here on Earth, it's always full.

Either it's 100% full of liquid,
or 50% full of liquid and 50% full of air,
or 0% full of liquid and 100% full of air.

Any way you slice it, it's always full.
Did the FBI advise Trey Parker and Matt Stone to change their names, "wipe their identities" and go into hiding too?
I'm using data from Project Votesmart (http://www.votesmart.org/services_api.php). At one point I planned on also using data from OpenCongress and OpenSecrets.org, but that functionality didn't make the cut for the initial launch.

Thanks for the link to Sunlight Labs, I'll check it out.
I totally agree with this comment. I don't know whether Diaspora is architecturally secure or not. I strongly suspect that it isn't, but am unqualified (and insufficiently interested) to constructively prove that.

The things I found were mostly tactical insecurities, springing from a combination of Rails Security 101 errors and "web application programming is hard." They're pervasive tactical insecurities. Maybe they'll all get fixed if a lot of people pick over every line of that codebase for the remaining one month before release. But that won't help address the part of the iceberg below the waterline. (I can't see it, but the amount of ice above the waterline strongly suggests it is there.)
From an educational app:

if($_GET["action"] == "score") {//that's what she said
A better title might have been "Some thoughts on the Diaspora software license and contributor agreement."

It's alpha software. It's not perfect. They're not going to get everything right on the first go, be it software bugs or maybe-too-restrictive licensing. Let's give it more than 24 hours before declaring it 'dead.'
Ooh, yuck. I'll look into that issue. Thanks for reporting it.
I may have been unclear - I'm not denying that GC is a good thing, but GC with TRIM is substantially better again than GC without. TRIM is just a way of putting more blocks into the G, to be C'd.
Look, the post has eight hundred and nine words which break down to four thousand four hundred and seventy two letters (according to wc). It's pretty dense in content, there is no fluff - most of the words are important. The above comment addresses fourteen letters (or 0.3% of the post's content). This is now all we're discussing. The rest of the content is pretty much ignored.

As far as I can tell the hours are completely tangential to the main topic of the post. If that one line was removed, suddenly the main thrust of the comments here would have been totally different. Let's not turn into a community that focuses on soundbites, please. We can be better than that.
1. They're allowed to make $200,000 off of the community but other developers aren't?

Where is your great, timely, mind-share grabbing, relevant-to-the-times project?
I would like to contribute money towards it.

Otherwise, stop sounding like such a h8r !
Yep. And I don't want to help too much, because what happens if I only fix some problems? I can prevent against basic stuff, if their crypto is bad, that's above me. And if I fix some of it, and then somebody gets burned by something I didn't catch, I'd feel partially responsible.
What is the difference between a pre-alpha release, an alpha release, a beta release, and a public release, from the perspective of a 20 year old college co-ed who is looking at an IM window saying "Hey, Facebook doesn't respect our privacy. Come sign up for Diaspora (linky), it is like Facebook except they won't send your photos to your mom."
i found tony hsieh's Delivering Happiness to be a very good read with respect to developing a culture you're proud of.. it's a nice look at what i like to call "tribal ethics." any other recommendations?
Just because he's a CEO and you don't find the articles interesting doesn't mean that he shouldn't be posting them. As it's been said HN is full of entrepreneurs who contribute massively to the site. If you have a problem with that maybe their not the one's who should leave...
No denying the influence of GNU, but have you noticed that commercially tolerant licenses are becoming more popular and businesses are some of the biggest producers of new major open source projects?
You're trying to say that early adopters don't know the difference between an alpha/beta release and a production release? Don't buy that.
I think this was mentioned in a recent issue of The Economist.

Just out of curiosity, is this were you found out about it?
How would it be safer for everyone? Most cyclists die because they are going straight through an intersection where a car is turning right. Move the bikes farther to the right, and it's even more likely that they'll be turned into.

Very few people die because they get hit from behind, despite that seeming like the most likely way to get hit. Drivers use the "see and avoid" principle -- if they see you, then it's likely they'll avoid you. If they can't see you (because you're way off to the side of the road), then they have no opportunity to avoid you.

When you "take the lane" as a cyclist and drive your bicycle with traffic, it's very hard to not see you. People will get annoyed, honk, and call you a bastard, but you'll get to your destination safely. And for me, being able to safely go anywhere I want on 20 pounds of steel is much more important than letting a few cars get to the next red light a few seconds faster.

Anyway, we don't need any new infrastructure for cyclists. We need automobile drivers to have a better attitude, and learn to share their resources.
ABC Introduces iPad App that syncs with Television Show
http://github.com/facebook/platform

Facebook Open Platform is a snapshot of the infrastructure that runs Facebook Platform. It includes the API infrastructure, the FBML parser, the FQL parser, and FBJS, as well as implementations of many common methods and tags.
http://developers.facebook.com/fbopen/

Design work will need to be done from scratch. But I think there's some good basic structures in there.
Yeah maybe I got confused at the part where they said "We think we can replace today's centralized social web with a more secure and convenient decentralized network."

http://www.kickstarter.com/projects/196017994/diaspora-the-p...
Thing is, the valley has a really lovely concentration of early adopters. While there are lots of early adopters around here too, it's still different.

Like for example, we're making an iPad app. Just because we're from Europe we were a few months behind people from The Valley simply by virtue of the iPad becoming available much later.

No matter how much we try to hide from this fact, the web happens in the valley and "far from the eyes, far from the heart" rings all too true.
One more reason to love Patrick. :)

Thank you for taking the time to edit this list and share it.
Me too. Why is there a lot of doubt about this project? I mean what stops me from forking FB open, add my own designs, my own glue code, and run it?
This is why anonymity online is still very important.
Then you're obviously not subscribed to diaspora-discuss or diaspora-dev.
Spotlight Your Service: Entrepreneurs Should Tout Military Ties
Well. Obviously you have a right to your opinion.
Strange summer melt leaves Arctic ice near record low
None of the projects listed above are AGPL-licensed. AGPL is egregious in its viral nature.
not so sure about that. If you, for example, build a google buzz interface to the facebook backend, you can take advantage of the federated open stack that's being backed big time by google itself, as well as the Mozilla project (ie Salmon protocol, etc)
Diaspora is delivering on their promises to their contributors. There is no problem.

Fundraise for your own project and you can run it in any way you see fit.

Write the code yourself and you can license it in any way you see fit.

The Affero licensing prevents some commercial venture from using their code as a foundation, creating a hosted service, tacking on some proprietary candy that locks users in, and out-marketing them. I'm fine with them safeguarding against that.
This one: http://stackoverflow.com/questions/184618/what-is-the-best-c...
Automotive X-Prize winners top 100 mpg
This seems like saying that Costco is starving the poor because you have to have a membership to shop there. It's true, you do, but there are plenty of other stores selling the same products that don't require the membership. You don't like Costco's rules, you can go somewhere else.

Archos did this; they couldn't use Google's marketplace on the A5IT, so they made their own market. Now it sucks because they have no clue how to program, but the fact that it's possible shows how open Android is.

Don't like Google's rules? You can completely remove all traces of them from the code they gave you.
Looks good. The only criticism I would have is that those inclined to install JGR and Deducer are those least likely to be interested in GUIs.
Ask HN: What are Unit Tests and Why are they important?
Okay, to say that I don't have the slightest idea what unit tests are may be a little misleading, but really, exactly what purpose do they serve? Is it kind of like Autoconf for php / ruby / whatever?

Do they test for things like XSS or just to see if you have GD installed on your server?

Is it terrible that I am not creating unit tests for in-house php based web apps?
2. Open Source projects require that you sign your copyright away and assign it to them or offer them a license on compatible terms with their license. Signing a contract to assign your rights or offer your contribution under AGPL is standard fare. How many open source projects did you contribute to where you DIDN'T have to assign your rights?

1. They didn't "make" $200,000, they got $200,000 in donations, and yes, people should be allowed to accept donations. If you don't like the terms, don't donate. I'm sure the Diaspora guys would love it if someone put up another kickstarter page accepting donations towards contributing to the Diaspora code base.
Really this is the least of their problems.
Elegant Wedding Invitations & Offers
We are offering you the best and unique designs for photo wedding invitations at affordable prices. If you want to get the complete information about Wedding invitation printing, luxury wedding invitations and photo wedding invitations do not hesitate to visit our site invite-to-wedding.eu/
Use an extremely restrictive and viral license that will force companies and "serious" developers to release the source code of derivative works.

Wasn't that kinda the entire point of diaspora, to be open, this is really just the guys ensuring that it stays that way. Sure it sucks that you need to sign a contract but in order to maintain that it remains open, it needs to be restricted.

Yes i know how that sounds.
How do they have so many XSS bugs if they are using Rails 3 which does automatic html escaping?
That quote got me thinking, though, about the question they did not answer:

What about languages that are read top-to-bottom first?
A great way to thank people who help you out
Here's an idea, let me know what you all think.

Lots of times, someone will do a favor for you, and you might want to thank them or wish you had a way to show them your appreciation.

What if I came up with a service where you pay me a few dollars (or whatever) and I'll ship them a beer with a nice note (chosen by the person)? Almost a little bit like Flattr.

Nice copy, nice design, thanksbeer.com or something way catchier.

Thoughts or ideas?
Diaspora is based on salmon, push etc
The idea behind unit tests is quite simple - you're considering your code as several black-box abstractions divided by abstraction layers with clean interfaces. Unit tests are used to be sure that after any code change each black box is still working as it should (gives the same output for the same input data) and so do each of your interfaces. Think of self-test of an aircraft - thats it.
I hope this gets ported to OS X and Windows
Unfortunately social networking is about market share.
This is terrible, but I'm conflicted. I very much respect this cartoonist for taking a stand, but she shouldn't be surprised at the outcome, people have been killed for this sort of thing before.

http://en.wikipedia.org/wiki/Theo_van_Gogh_(film_director)#A...
This isn't "software security expertise" this is a team of people not communicating at all with each other. For example, the Photo controller

edit (show edit form) checks that it's your photo to edit

update (make changes to photo) does not, you can update anyone's photo to anything

destroy (delete the photo) does not, you can delete anyone's photo w/ the id.

This is stuff you just DON'T DO in a web app. It's something any self respecting web developer, especially Rails developer, will look at and shudder. And those are the simple things that immediately stand out. Who knows what kind of security failures are built into this system due to ignorance or just plain lack of care.
Not to mention those that changed their names into made-up words: Standard Oil of New Jersey -> Exxon.
Sure, the names don't mean anything. Gmail was in beta with millions of users for years.

However, the Diaspora github readme says this in bold:
"PLEASE, DO NOT RUN IN PRODUCTION. IT IS FUN TO GET RUNNING, BUT EXPECT THINGS TO BE BROKEN"

So, shame on the register for calling this news.
This is a dumb idea for a project.

Diaspora? Or doing a security audit of Diaspora's code?
So, you are put on a crazy muslim's hit list.

Do you

A. Run?
B. Fight?
The Koran burning fiasco generated a lot of criticism by peaceful muslims, but I wonder if they also criticize the myriad flag/effigy burnings by angry muslims across the world?

Terry Jones was just plain dumb to propose burning the Koran (not least because he would be up in arms if the Bible were to be burned). But in my view, muslims who are offended by Koran burnings should be equally as offended when people burn American flags and effigies in the name of Islam. Yet somehow I think their concern dies down for the latter, and I view it as a real problem.

But I have to say, the muslim clerics defending the Islamic center in NYC are really a credit to their religion when they oppose the Koran burning not on religious grounds, but because it will endanger American troops.
Thanks for the awesome advice. Just registered ob1e.com :)
"Divisive"? You think Gruber's sowing discord among the Android faithful? I think he's highlighting a lawsuit that exposes some hypocrisy in Google's public branding, branding which some people have taken a wee bit too close to heart.
Yes, as of 35 minutes ago, it says that. But before that, it didn't, and tons of people are throwing this up on ec2, heroku, and everything else: http://github.com/diaspora/diaspora/commit/e668071ea51050ae7...
Interesting. So people who have gone through the trouble of subscribing to the development mailing list don't know that this code is nowhere near production release? That's.... odd.
I haven't read the code or the design, but I'll say:

* To the extent that Diaspora's security depends on Rails, their problem is tenable; Rails (when properly configured, which this project isn't) does a really nice job of making CRUD secure.

* To the extent that Diaspora's security depends on cryptography, we needn't worry about the security of their current design at all, because they have no current design; what they have instead is a "hello world" of cryptography; someone professional (or in academia) will need to design something for them, and then write a paper on it.
The Internal Call To Decentralize Twitter That Fizzled
The way language works, some sequences of characters are more important than others.

The way threads work, if you feel like discussing some other aspect of the article then you can go right ahead and start another top-level thread about it.

For me, the revelation that they routinely work twelve-and-a-half-hour days, every day, is the most important part of this "company culture" post. It's the one that, if I were considering applying for a job at this company, decide that there is absolutely no fricking way I wanted to work at this company.
I like to compare it with WordPress, what with wordpress.com and wordpress MU, etc. Rails and AGPL vs PHP and GPLv2. Admittedly Diaspora are two steps up on the language and license stakes but I don't think that's a real road-block. That's probably just small stakes. If it's popular enough, site providers will fall over themselves to enable 'installation' of Diaspora. People (theme designers mostly) complain about GPL in WordPress too, but lots of web designers are making custom WordPress sites and making money off it too.
Looking for discounted dentist (or any doctor for that sake) without any recommendations is not a good idea in the first place.
Your health is not something to joke with.
Come now, we don't call Microsoft or Cisco's (or any other) outsized profits a "sucker's chest" now do we? And, most of us either have or once bought a house or mechanized vehicle, and we didn't go there, look at the flyer and say "well, that's the price. Where's my wallet?"

Haggling is healthy, it's the lifeblood of commerce. If it's how retailers negotiate at the wholesale level, why can't we turn around and do it at the consumer level?

I think, if you call it anything, you should call it the "authority tax", because you're trusting their price as gospel because they're the big, scary faceless monolithic vendor of great success. They're just a business. We're all in business. We all should be looking at CDW, OfficeMax, Dell, Apple, as the same as us. It's American worship of the corporation that makes us roll over and give them all their 30% growth year over year, not the fact that they're "honest".
Analysis: Another Microsoft exec pushes escape key
So you're saying that people should just avoid doing anything that could possibly offend extremist muslims?
you can't compare Religous Book(Koran, bible, etc) to a flag. they are totally different, flag represents one nation while the other (religous book) might represent many nations. muslims don't burn Bible. americans can burn iraq's or iran's flag and no body will speak about that.
From a practical standpoint not being allowed into the Android Market is a death sentence. The only way alternative App Stores would catch on is: a) carrier or handset maker replacements b) piracy stores c) increased restrictions on Google's Market that create a demand for a free App Store. None of these options are good for developers so maybe the FUD is somewhat justified if the only solution is making it more difficult for a user to obtain your app.

That being said it hasn't happened yet so making an issue out of it does seem FUD-ish. It comes with the territory though. If you want to dominate a market you have to expect scrutiny. People are endlessly entertained by (perceived) hypocrisy. Google pimped Android as being the open alternative so anything they do, however minor, to distance themselves from that is going to be big news. Android has clearly hit that critical mass where negative stories are becoming more interesting than positive ones.