skysight-inc/HackerNews huggingface dataset:
Wordpress themes aren't the only ones guilty of this. Shady plugins also contain hidden code.

http://www.themelab.com/2009/12/08/stop-downloading-wordpres...

TAC (Theme Authenticity Checker) isn't a bad place to start searching for malicious code: http://builtbackwards.com/projects/tac/

However, the only real solution to this problem is to run a limited set of extremely trustworthy plugins and build your own themes.
Yep. I've paid for a bunch of apps including BeyondPod, Vignette, Feedr, SwiftKey, TradeDroid Pro, gStrings and Soundhound. Why not? They're cheap and very, very good. If it's less than $5USD I'll probably not even notice, and between $5 and $10 I'll evaluate the app a bit more carefully first.

I also paid for SplashID because I've used it for years on Palm and it was great. This one I resent because it was expensive and the Android app is a bit shit. I'd really like a quality password/secret thing app with desktop sync and would buy that too.
From Cancer to starting his own company
The Doctor looked at the bump on my neck and said "it's nothing, but we'll do a biopsy just to be safe." . . . But what company is going to hire someone who says "I now have enough energy to put in a good 3½ hours/day of effort?" Not gonna to happen.
I have and I will again. I just spent $6 on an app called Tasker (great app). I like supporting the developers who make my experience on my phone better.
There is a difference between the already vetted produce of someone like HCB and the raw produce we are dealing with here. Of course he produced crap, but that crap has never seen the light of day. I doubt anyone wandering upon a pile of thousands of his photographs would consider them automatic gold.
This is the first I've heard about a virtual credit card; pardon my ignorance but can you tell me more about this? Email is in the profile.
Oh and I really dislike ad-supported apps. Handcent is the only one that I can think of that's not annoying, because the ads only show up in the config screens. I'd rather pay.
A Low-bandwidth Network File System
> Though it can be argued that it's possible in some cases it's both; in the case of Gawker, perhaps there was a theme add-on that possible opened or exacerbated a hole resulting in the password leak.

Gawker run a custom platform, not Wordpress.
I'm inclined to think that the author is not doing anything malicious, the js code is obscured/minified so it's hard to verify that. I'll say that the analytics script has the sole purpose of tracking real usage (the webstore doesn't provide any info on "active" installs).

Other than this, the author already received a comment pointing out the existence of readability, i hope he'll update his code soon.
@JohnWatson

Serendipity! I was thinking the same thing -- though I was thinking more along the lines of Quora posts.

This is a feature I have posted about and asked for on Reddit actually; the ability to tag information to topic and quality etc.

This would really apply to quora best though, as the information is already sorted in one dimenstion: quora topics.

I'd like to be able to assemble and curate information from sources like quora and get them into a more of a how-to; infact I posted a question along these lines on quora, with little response.

(http://www.quora.com/Would-Quora-users-like-an-entrepreneurs...)

However - I predict that this will be a golden goose of social search. A question is asked within a particular topic, experts respond - then the best answers to the most popular questions within a topic, and tagged by the audience, are assembled into cliff-notes of information on that topic.
Wordpress isn't responsible; the faults are due to the design of PHP. The availability of the eval() and base64_encode() make these sorts of attacks basically unpreventable in untrusted sources.
Ah, thank you for the correction
I think the fact that the authors were using base64 encoding to hide it answers your question.
UrlReveal - Reveals the final destination of short/redirect URLs (with source)
There is a service for this called Earth Class Mail.
paid software is a dead idea. a few protected niches, monopolies, people ok with making midling amounts off .99 sales will lnger on. the echo chamber revertabrates appstore / indie hit but cancels outs the thousands of flops

saas, subscrtion, powerups(in app purchase ala zynga), side channel sales (like mint, affiliates, 3d print avatar) and the like are the present and future making "big" money in software.

everything else is amature hour and/or playing the lottery
> It was hard enough to make you feel smart for knowing that the third moment of a distribution is its skewness...

If you think that makes you smart, then I want you to be my competitor.
Hasn't this been on HN already?

Anyway, just stick to wordpress.org/extend/themes - those themes are all under the scrutiny of the community and there's a group of peoe who are ramping up to do code reviews on them.
Many of the comments in this topic, and yesterday's "Ask HN: Do you meditate? How/Why?[1] have a skeptical tone.

reader5000: "I would like to see these sorts of studies controlled with a group"

Swizec: "What I'd really like to know is whether these changes are permanent"

andrewwingram: "I'd like to see if this is backed up by similar studies."

haecib, "what I really want to know is do those changes in the brain's structure manifest in any sort of measurable cognitive improvement."

It's possible no skepticism is intended in the above cases, but let's say it is. Certainly there are some skeptical people. And hesitation is implied, as if, 'Once it's proven that meditation has certain benefits, then maybe I'll try it.' There's nothing wrong with skepticism and hesitation. These traits can be lifesaving, but there's an opportunity cost whenever these traits guide behavior.

The opportunity cost for a 6 or 8 week meditation trial is very low. We know enough to see the potential for a positive result, which may be modest or huge. So you don't see a few movies, so what? It's not like you can't see them later. Just try it.

I'm fine with a modest benefit, whatever it may be, but what energizes my practice is the big stuff: seeing clearly, substantially more skillful action, happiness not based on conditions, equanimity, even the big E. I can't think of any other activity, not even starting Google, with that kind of return.

[1] http://news.ycombinator.com/item?id=2125115
Not only the free themes but I see many pirated commercial packages on torrent websites. It's very tempting to download all these 50 woothemes, even just to try them out ... but the fear of hidden code just too strong.
I would find your own path and avoid drinking the silicon valley / VC-hyped Kool aid.
7 Things Not to Do When You Build a Business Online
And not including eval and base64_encode would be ridiculous. No programming language is at all difficult to do nasty things with if you decide it's a good idea to include random untrusted code snippets.
Oh no, not again.

http://news.ycombinator.com/item?id=1253120

http://news.ycombinator.com/item?id=1357390 <- This one has the comments.

http://news.ycombinator.com/item?id=1376655

http://news.ycombinator.com/item?id=1383943

http://news.ycombinator.com/item?id=1390588

http://news.ycombinator.com/item?id=1397443

http://news.ycombinator.com/item?id=1466084

http://news.ycombinator.com/item?id=1646229

http://news.ycombinator.com/item?id=1728970

http://news.ycombinator.com/item?id=1982776

... and many, many, many more.
there are equivalents to eval and base64_decode in most languages (javascript, perl, python, ruby, etc). its not particularly the language's fault, either.
No worries. Gawker was compromised through ordinary social engineering, basically. In some ways these faux themes are in the same class of attack.
Some inventories you can use to measure your level of mindfulness:

http://www.mindfulnessandacceptance.vcu.edu/tools.html
Chris Dixon's Startup Wisdom
>Subscribers will have limited access to archives of Times articles and features dating to 1980, and will be able to copy articles to their own computers for $1.95 each, Mr. Nisenholtz said.

Any idea on how this download-fee was implemented?
Wasn't Page responsible for Google's whole mobile strategy including the purchase of Android, Inc.?
Show HN: the Future of NASA
PyCon 2011 Needs You
There are, but in retrospect these features might be worth removing from a web-specific language, along with shell-out capability.

edit: why the downvotes? Are these functions truly indispensable for this particular domain?
There was a chapter on this in Beautiful Code. Cool stuff.
infochimps.com
I Wanna Be An Engineer (video)
Sandboxing would be helpful. Java-like or Lua-like.
The whole WP ecosystem is very insecure. For example, it's trivial to add a back door to a plugin that gives you full access to their server. Wordpress desperately needs to add a screening process. You can't assume everyone will do a code review before installing stuff even if they should.
Anyone know if contributed code for other website platforms (Drupal, Joomla, DNN) etc. has similar issues? Is there any sort of "vetting" that goes on?

I actually worry more about the cheap but commercial modules, vs. the free/open source ones. With open source modules, chances are someone has perused the code looking for any signs of mischief. With the commercial code, often authored in another country, who knows?
With regards to the join and capitalize examples, once you consider the existence of the string module, the current way actually does make more sense.

Capitalizing things only makes sense on a string. Having a builtin function that could capitalize any input doesn't work, so it's better to explicitly make it clear that it's a string related function. If, for some reason, you're allergic to list comprehensions, you could always do map(lambda s: s.capitalize(), strlist).

Similarly, the string module has a join function, whose definition is: return sep.join(words). The standard ''.join() is unfortunate and unobvious to the newcomer, but it's idiomatic, and there probably are unusual cases where calling a non-method join doesn't work.
The first one I bought was the hardware accelerated version of my guitar tuner, gstrings. I also bought a cool sequencer/composer called Loops. Over time the barrier has gone down significantly and I've bought more.

My price level for no-brainers feels like $2. More than that and I search for reviews and such.

I tend not to buy unless I can try first.
More importantly (and annoyingly), if I define a top-level method with def—let’s call those top-level def methods (TLDMs)—Ruby won’t let me pass it as a block to any other method. (TLDMs actually belong to an object, so strictly speaking, this makes sense. It’s still annoying.) In Python, we can pass lambdas and TLDMs like they’re identical.

...

This is a problem because Python treats methods and functions differently. You can pass functions to other functions. But you can’t pass instance methods.

In Ruby, you can pass "TLDMs" by passing the symbol corresponding to their name, and calling send() on the symbol to call the method. Likewise, you can pass the object and the symbol in order to pass a method around.

Ruby lacks list comprehensions

Ruby does have the select method, which is semantically equivalent. List comprehensions are syntactic sugar for select (and I'll freely admit that Ruby can have a pretty bitter syntax at times, so maybe the sugar is justified).
> Anyone know if contributed code for other website platforms (Drupal, Joomla, DNN) etc. has similar issues?

Absolutely. It's common to all these programs because they all use the LAMP architecture, which includes PHP (eval() and base64_encode()) and an inability to securely partition the data (can't have multiple users in the DB).
Two disconnected thoughts that came to mind reading this...

1. I agree with Google's approach. Microsoft spends $10 billion a year on R&D yet I can't think of a revolutionary product they've come up with (Kinect was bought from the outside)

2. I notice the word "patent" is never mentioned in this piece. A big reason companies like Microsoft and Intel have research labs is to patent protect themselves in the future (wasn't there an article on HN just a few days ago that mentioned Google's anemic patent portfolio?)
While your fear of hidden code is probably well-founded, I don't think it's piracy to redistribute the WooThemes. They have been released under the GPL. (http://www.woothemes.com/2009/06/woothemes-gpled/ and http://www.woothemes.com/terms-conditions/) For what it's worth, I've happily paid for the WooThemes I use.
Those answer explain HOW they can afford to put them online - not why they should.

The answer is Brand Recognition. MIT isn't competing with the places people would have gone to if they couldn't read this stuff online - it's competing with Stanford, Harvard, Caltech, Dartmouth. It could outbid them for better teachers, it could hire famous noble prize winners, it could publish important scientific papers.

Or it could associate MIT with computer science lectures in the minds of potential students, future hirers of future students and the world in general.

Oxford published the "Oxford English Dictionary" more than a century ago - rather than keeping the secrets of what words meant for it's students - and 150 years later it's still paying off in selling English language courses in China.
OK, I would like you to introduce me to a programming language where installing source code downloaded from an untrusted website on the internet does not come with security caveats. Care to do so?
The only thing in a stealth instance that is aging is the domain name. You aren't really sharing that much content if in stealth. There may be some ancillary value from links from high value site talking your stuff up.
Dirty sheep can look yellowish no? And bronze is Yellowish.
Are You Really a Strategist?
I think you're confusing the research wing and the education wing of the modern research university.

Research grants are given to professors/staff to fund specific projects, which are separate from/in addition to their everyday teaching responsibilities at the university.

Now, I'm not saying the two funding pools don't ever mix, but they're not the same.
Sure. The JVM was engineered to include sandboxing for unsafe functions (disk access, for example). Lua allows quite granular sandboxing (look at what WoW takes away).
Original article needs some basic education in economics. It certainly isn't a Ponzi scheme, but, that is a different discussion that already happened - and appears to be dead or searchyc doesn't find it.

I ran 2 campaigns this week for a hobby project. Decided I would throw $100 into the wind and see what came of it. This is the ad that played from their preview, I didn't think to screenshot it from the profile view:

http://cd34.com/hr.png

Targeting

* who live in one of the countries: United States, Canada or United KingdomSee More
* age 18 and older
* who like apollo 13, nasa, space shuttle or space shuttle program

First run, 46849 impressions, 28 clicks, cpc $.34, Spent $9.56, resulted in 1 confirmed action, 1 that possibly bookmarked. Ad was paid based on $.50/cpm

Second run, 41890 impressions, 28 clicks, cpc $.80, Spent $22.40, resulted in 1 confirmed action. Ad was paid at $.80/click.

So, from that minor test, we can conclude absolutely nothing. In order to have any chance of valid data, we need two or more confirmed actions. So, what we did conclude is that it appears paying facebook by the impression for a non-branding ad is a little more cost effective in this case. Until we get a 2nd confirmed action, we really have no idea. What if the next view generated a click, our ratio would be halved.

What I think I can conclude from the first two tests is that the landing page (the twitter account) was an extremely horrible place to drop someone off. I ran out of time to get a nicer landing page which I will probably do before Apollo 13.

Key points, I'm not selling a product, I make no money from the project, but, was interested in testing a few things as a precursor to something else. It wasn't worth $30 to me for 2 followers on a twitter account. I do believe a better designed landing page rather than tossing someone to twitter would increase conversions substantially. There is still residual traffic from it, and it has gotten two more followers, but, I cannot attribute those to facebook.

Now, that is data collected this week. Historically, I can say that the ROI is marginal, but, most of the items I've advertised are not impulse purchases. Getting a person to contact us and the requisite followups close the sale. As far as lead generation, I would say that it is not a bad deal, but not great. Because of the way the pricing works, once you can figure out your ROI, you bid what it is worth to you, the people outbidding you eventually figure out they are paying too much, and the bid prices get regulated.

I would bet that 90% of the people complaining about their ROI on any advertising, aren't tracking enough metrics to even know why their advertising isn't working.
Who makes up "Sent from my iPhone" messages, and why?
Given that they're a volunteer project, what's the OSS project need the money for?
Pure creativity and innovation. The Facebook game - FantaPokas Poker.
I think the answer to that question is genius and hard work.
This brings to mind the wonderful http://en.wikipedia.org/wiki/Henry_Darger who is one of the more well-known examples of outsider artist.
This was also on here awhile ago, with some interesting discussion:

http://news.ycombinator.com/item?id=477046
Ugh. I'm going to be regretting my snarky comment about the Referer header very soon :P
And here is his profile from the previously linked The New Yorker article:

"He is a very private man, who often in meetings looks down at his hand-held Android device, who is not a comfortable public speaker, who hates to have a regimented schedule, who thinks it is an inefficient use of his time to invest too much of it in meetings with journalists or analysts or governments."
The whole point of having join() as a method on the string is that it is meant to handle any kind of iterator. You can join a list, a generator, or the custom iterator of your choice. In any of those cases, it looks the same and is implemented only once.

If join() was not a string method then it would have to belong in some mixin that you slap onto your iterators, and that increases code complexity.

Also, you can do things like map(operator.methodcaller("capitalize"), iterator_of_strings), but that is probably bad style.

And in Ruby you can do your_object.method("foo") to turn your method into a lambda.
And that sort of sandboxing would prevent a theme from hiding some spammy HTML in its code? I can think of many ways to do that, some of which don't even involve templating-level functions and just rely on the HTML level alone.

You're comparing apples and oranges here. You can run PHP in "safe mode", as many shared hosts do, to prevent shell access and disk access by PHP code.

The only problem here is one of misplaced trust (and perhaps WordPress allowing PHP in templates instead of using a dedicated templating language). People installing WordPress templates generally a) don't care where they come from and b) don't even read the source code, so this theme could probably include such links without any obfuscation and still successfully spread.
I've had an android phone for about 6 months and haven't paid for any apps. In general I've found that for every paid app, there's a free app which is close enough if not better.

I also dislike the idea of buying software for a device that I'll be replacing in a couple years anyway. I've been burned by planned obsolescence in the past.

Not to mention I'm usually only on my phone for a very specific set of tasks, and I've already near-optimized those.
Cold War Cryptographer to Genetic Anthropologist
Wow, and you actually find these books valuable? Any book I read that I truly learn something from usually takes weeks or months to get through. Call me slow but it just takes time for real information to sink in for me. Sure I understand the words, but to fully absorb the knowledge takes time. Reading 200-400 books a year - how do you ever get the chance to absorb any of that information? If you can really learn valuable information from a book in 10-20 minutes than I am jealous.

Maybe business books are just different than technical/science oriented ones.
Not to mention that even if they haven't been explicitly released under the GPL, they are derivative code upon a GPL-licensed piece of software and thus GPLed themselves.
Or a more generalized version is "Give away your ideas, sell the system."
No Deposit Bingo Bonus
It's a great question to ask, and the point about how strategy is future-focused is a good one. I don't particularly agree with the recommendation: everybody at the company should be strategic, and at a small company there's no room for a full-time strategist. There are plenty of great strategy books out there; Sun Tzu, Crossing the Chasm, Robert Greene's 33 strategies, 'balanced scorecard' and strategy maps ... you want to learn the general principles as well as how to apply them to the kinds of situations a startup is likely to encounter.
Education is as much about content as it is about the social experience. Putting videos of the lectures online is a great way of distributing content, but just like books, it is not enough. The experience of going to a class with other people and collaborate on projects together has not yet been fully replicated online. There are some nice initial attempts at doing that such as openstudy.com, curiousreef.com and to some extent scratch.mit.edu (disclaimer: I created that website). It might be that we will always feel the need of face-to-face interaction for our learning experiences, but you could imagine a nice combination of meetup.com + some online social space + content. As for reputation, I think things like this (http://scobleizer.com/2011/01/02/crack-for-technical-recruit...) point out future directions.
It was Singh's book got me interested in crypto when I read it in 9th grade, but it really made me smile to revisit this!

Since leaving GCHQ, the NSA, and a hedge fund, Nick works as a genetic anthropologist at the Broad Institute. Last year I had the distinct pleasure of haranguing Nick Patterson with all manner of technical questions, mostly with regards to Hidden Markov Models. He never did mention his role in public-key cryptography. The NYTimes did a bio on him a few years back, it's a great read about an amazing person and intellectual giant.

http://www.nytimes.com/2006/12/12/science/12prof.html
http://www.broadinstitute.org/blog/five-questions-nick-patte...
I will only ever buy if the app is of a very high quality, and if I feel that it is essential for me to have. The only application that has come remotely close was Locale.
I said this in the post, but I want to make it clear here: the Origin header is not a panacea for CSRF. There are plenty of other elements that can render it useless as a form of protection, which I spell out in the post itself. However, it's definitely a cool use of the header (and one that I hadn't seen discussed before). :)
I found shorn sheep that look almost bronze. :)

http://www.google.co.uk/imgres?imgurl=http://photography.nat...

I've assumed things like the description of colours in these texts are an attempt to produce an idolised version in the minds eye of the listener. That is, an effect similar to watching a cartoon, or observing a caricature. The use of bronze is clever in that it gives a heightened image of something that is already somewhat observable to the viewer. But at times, perhaps there could be loaded meaaning in the colours that we don't appreciate easily, e.g. colour of wine and tyranian purple.
Sweet! You've done a terrific amount of research here. I just realized you have a pretty interesting profile too.