skysight-inc/HackerNews huggingface dataset:
Yes. With PHP, you generally put code in the web root. This is a terrible idea, because if your PHP parser becomes non-functional for some reason (or is accidentally disabled) your source code is exposed to the world.

With other web frameworks it is generally encouraged to put source code and static content in different directories. With the code completely outside the web root. This is much safer: never put code (or passwords) in your web templates.

It is possible to do this with PHP, but in practice almost no one does that. PHP, in my experience, has a lot of these insecure-by-default issues.
A human error caused some sensitive server...
I also replied to al3x here: http://news.ycombinator.com/item?id=2342918
The tragedy is that the reaction of the mainstream media to this existential crisis is to unwittingly accelerate it.

The key problem is that local news sources (newspapers especially) have traditionally had relatively exclusive "broadcast" privileges to their audience. This let them make money from the broadcast business alone: selling classified ads; re-broadcasting weather reports, national and international wire reports, syndicated comic strips, etc. This is a low cost high markup business, so media grew fat off of it, and sometimes lazy. It's easier and far more profitable to fill a paper with human interest stories and re-broadcasted content than it is to do hard nosed reporting.

The internet has vastly disrupted every manner of broadcast exclusivity in existence, especially newspapers. Classified ads are obsolete in the face of ebay, craigslist, amazon, monster, and even facebook. Day old printed weather information is similar obsolete in the face of weather.com, wunderground.com, etc. Reprinted comics are similarly obsolete in the face of online access to not only the exact same comics but also a bevy of webcomics, many of them more appealing to various individual readers than the one-size-fits-all lowest common denominator of the newspaper. The same goes for opinion pieces and re-printed news. This leaves the value of a newspaper down to nothing more than it's unique coverage capabilities (e.g. local news) and basically whatever legitimately original reporting they do.

However, as newspapers have been faced with economic doom due to the loss of most of their revenue their response has typically been to foolishly double down on exactly the traits that have gotten them into trouble in the first place. To cut back on expensive elements such as original reporting and fall back on the cheap stuff. This'll work for a while, but it won't ultimately stave off doom as increasingly people will discover the value of the paper is diminishing and becoming less relevant. People will more and more find that life is just fine with out them, the process will accelerate as more and more people of every demographic follow suit.

Meanwhile, it'll be up to others to carry and to elevate the standard of journalistic integrity.
just found this - http://www.addtoany.com/ext/google_analytics/
I tought tumblr.com was build with Ruby on Rails.
I guarantee you that Tumblr has display_errors = Off. This wasn't a display_errors related fuckup, it was a missed opening PHP tag.
Twitter was never a protocol. SMTP, http, XMPP are protocols - a data exchange description explained in an RFC where anyone is free to do their own implementation of it. Twitter is just a fauxpen API for a private company's massive platform. The idea that no one has created a true microblog protocol (like a realtime USENET) is a testament to the incorporation of innovation and a lock-in economy.
You still miss the point. The point is if I want gcc, make for compiling ruby. This projects are supposed to be free/os/shoud-not-paid.

The point is I do not care about Xcode and iPhone development. The point is I want to compile and run the last version of Ruby.

I really frustrating that all easy mechanisms (install developer tools and you have everything) is gone in the paid land.

If I have to leave the Apple ecosystem, fine. But I was looking for less drastic way. Someone who made a "get-all-these-app-witout-apple-xcode-stuff-because-you-shoud-pay-for-that" will be a good solution.
In the abstract, i understand, why anyone would post this. I get it, and maybe i'm getting older or something, but part of me equates posting this sort of thing with pointing at an acquaintance on the street with his fly down and having a laugh with your friends rather than telling him and having a chuckle after he's zipped up.

But the whole self-righteous and incredibly passive-aggressive "man, i think these guys have a huge problem..." followed by the "man, these guys need to shape up" and "n00b mistake!" are unproductive to the extreme.

I mean, find a bug, report it, move on. Maybe i've got some unrealistic notion of karma or general human benevolence or something, but it seems hard to believe that this is such a difficult path to take especially when nearly everyone commenting has to deal with bs of this sort day-in/out.
First of all: thanks for writing the post. I was one of the people who asked you to, and I'm glad you took the request seriously. It's much easier to see now what you're up to.

Now: I think you are misunderstanding the nature of the problem. What makes HN HN is not, by and large, a function of the software, but rather, a function of the people who happen to hang out here-- who were attracted by something other than the software.

So, if you wanted to get an HN-like-community gathered around, say, knitting, you'd need some way to get a large enough community of knitters together together to get the ball rolling to create traction (i.e, the chicken-and-egg problem.) The easiest way to do this would be to have the active, committed involvement of the-Paul-Graham-of-Knitters, whoever that might be.

For an object lesson in how this works, take a look at StackOverflow. They were able to get immediate traction because the pump was primed by readers of Jeff Atwood and Joel Spolsky. Note that they have not yet been able to gain similar traction in any other vertical, and have a lot of VC money working on it.

That being said: what is the salient difference between "A Hacker News For The Rest Of The World" and "Reddit"? What can I do with your software that I can't with Reddit? Follow up question: is this advantage significant enough to make up for the enormous head start they have in terms of users?

EDIT (I clicked before I was really finished, oops):

Finally: "a hacker news of the rest of the world" is not, in my mind, a pretty solid elevator pitch. HN is not a business, and generates no revenue. And, the people who hang out here are not at all like "the rest of the world" in many ways-- in fact, some of us take pride in being outliers. So, I'm not really sure that the notion is solid. If you got traction, I can't begin to imagine how you'd keep the trolls out, or keep the conversation focused in each of the "interest networks".

Still, I wish you luck.
It's been taken care of http://staff.tumblr.com/post/3959106211/update-regarding-sec...
Yes, but included files still need a <?php tag at the top, or PHP just prints them out.
But would it really be that difficult to give me the citation so I can look up the paper in my university's database, or pay for it online if I'm that interested? A proper citation instead of "scientists from the university of blah" is still an improvement.
The Scientific Method is OK; The Decline Effect is Stupid.
Getting Started with BASH
I was in the earthquake in Tokyo (a few kilometers from Odaiba where that video was likely taken) and I can say I believe it. Out this far from the epicenter it felt very wobbly. It was like my house was on a block of Jell-o. It felt like a 1-3 htz wave. There was a good three minutes of very strong movement and another severe aftershock a 10-20 minutes afterward.

BTW, The girl having a picnic with her boyfriend when the video starts is shouting こわい (kowai) which means "scary!".
About that... I make no use of the user's browser history. But I need the "tabs" permissions. I also have to be able to access all urls. I could indeed access all your history and data with these permissions but that's a byproduct of the functioning and intent of the extension. I make no such thing... Just highlight code. Here is my manifest.json

{
"name": "Sight",
"version": "1.6.3",
"description": "The Syntax Highlighter for Chrome",
"minimum_chrome_version": "8",
"background_page": "background.html",
"options_page": "options.html",
"permissions": ["tabs", "<all_urls>"],
"page_action": {
"default_title": "Change language",
"default_icon": "images/icon19.png",
"default_popup": "popup.html"
},
"icons": {
"16": "images/icon16.png",
"48": "images/icon48.png",
"128": "images/icon128.png"
}
}
no. this was a config file with a broken <?php-tag. it'll be treated as a plain text file when included/required.
Typos are very easy to make - but that's why you need to first test your code locally, test your code in a development environment, have others test and approve your code in a staging environment before a small typo gets to production where something like this can happen.
You can clearly see all the routes in the app. 400+ routes and only 11 controllers. Most routes are concentrated on 3-4 controllers. Each of those controllers has got to be 10,000-20,000 lines apiece.

The dashboard controller alone has approximately 120 actions.
I never said you need Xcode.

The easy way to install the last version of ruby is to compile and install from source. If I want to do that, I need make, gcc, etc... Actually, if I want to install that tools easily I need to install Apple developer tools... and now I have to paid for that.

Okay, I can download and install each software from the apple.com/opensource... put it is such a pain. I can download XCode 3.... but it is not the lastest nor the greatest. Okay, I can change my OS, but I love it. It is sad that I have to move from it.
Official update from tumblr: http://staff.tumblr.com/post/3959106211/update-regarding-sec...
Tell me the URL for me to debug please.
This bug is nothing to do with putting code in the web root. If you miss the opening <?php tag out in any file, regardless of whether it's in the web root, it will get printed straight out to the browser.
Oh, and I forgot, MacPorts, Fink and the Dan Benjamin way proposed on the link you send me require the Developer tools.
it's always included to the document root (the bootstrap file). it doesn't matter where you're including from, a broken open tag would cause errors like this one.
I think shoving an "hydrant up in the *" won't appear on the preface...
Does anyone who down voted me gave a shot to compile a c++ program without the developer tools?
Well, this is partially true. The output clearly contains error statements, but this directive would not have stopped the first 748 lines of sensitive information from leaking before the first error.
I believe you are wrong. include()/require() would equally happily display any file's contents outside of `<?php ... ?>` scope (the case with "i?php"), within document root or not.

Edit: I've tested this:

$ php -v
PHP 5.2.6-3ubuntu4.6 with Suhosin-Patch 0.9.6.2 (cli) (built: Sep 16 2010 19:51:25)
Copyright (c) 1997-2008 The PHP Group
Zend Engine v2.2.0, Copyright (c) 1998-2008 Zend Technologies

$ cat test.php
<?php
require "/tmp/test2.php";
?>
$ cat /tmp/test2.php
i?php
define("TEST", "test");
?>
$ GET http://localhost/test.php
i?php
define("TEST", "test");
?>
Best of the Week - 19 marzo 2011
Since I wrote the first post of the series "Best of the Week" I noticed that so many people around the world was coming to see it. So I decided to write text and comments in english.

Other posts will remain in Italian but you can translate them using the automatic translation button placed in the toolbar below.

So, this is my list of best articles of the week...

enjoy it!
At Last.fm we had a Subversion pre-commit hook which ensured that all .php files began with <?.

That would have easily caught this problem, no drama.
Examples of Entrepreneurs Mitigating Risk
there are dozens of pages that have been exposed on this one server. I have no idea how the opening tag can get mangled in so many different files
I like where your heart is, I fear it will be hard to build true community with a boil-the-ocean approach.
Yeah seen a few client libraries that are doing that. Even putting them in a config only file lessens the chance of something like this happening as it is modified a lot less often.
If you have a PHP app, place nothing inside of web root other than an include to your front controller. This is all that should ever get exposed:

include '../app/front_controller.php';
TL;DR: Amateurish PHP developers at Tumblr fuck up; HN developers who don't know PHP that well make wildly incorrect assumptions about PHP.

People, I know it's en vogue to bash PHP (just wait, in a few years it'll be Ruby and Python - remember, PHP was once hyped, too, and now it's going in the other direction) - but if you criticize PHP, could you at least try to sound like you've actually developed in PHP for more than a week?

Because most of the negative comments here about PHP have absolutely nothing to do with PHP as such - the Tumblr error in question has to do with incompetent programmers. If you read The Daily WTF you'll know that incompetent programmers can screw up no matter what language they're using.
You're missing the fact that if you install any app, even a free one, you will be prompted to enter your password. Then for the next 15 minutes you wlll not be prompted again as your child takes the phone to play their new game and racks up thousands of dollars of in-app purchases.

This was a big story not that long ago and prompted an FTC investigation. Apple fixed it in their latest iOS update by prompting for the password every time.

Even for an adult, using the phone alone without a child's fingers prodding randomly at the screen, a popup with an instantly charge my credit card button and a cancel button right next to each other is hardly a peaceful and serene thing to deal with when it pops up unexpectedly as you try to hit the tiny button that you hoped would allow you to avoid this very question. That's why it reminds me of those "You are trying to leave this webpage! OK Cancel" things.
Which is why you have test servers and never ever make live edits to deployed code. I find it exceedingly easy to say that this was kind of incompetent.
This bug was nothing to do with the file being web accessible. If you miss the opening <?php tag out in any file, regardless of whether it's in the web root, it will get printed straight out to the browser.
+1 to russ. PHP syntax checking on precommit would have caught this.

Edit: I'm wrong. It does not catch this.
Research Paper Abstract Should be Written Meticulously
The research paper abstract is an important part of the research paper. It is a summary of the entire research paper and as a result needs to be concise and accurate. The abstract is written according to the number of words required and therefore, students need to adhere to it strictly.
This sounds like "insecure by default" to me - you have to have the opening stanza correct in order for the file contents to be treated as code.

Perhaps a more secure idea would be to require an opening stanza for the reverse - for content that should simply be printed to standard out? i.e. <?out to make content that should be outputed, not <?php for content that should be interpreted.
A sizable portion of reddit's recent success is owed to Digg's decision to do just this.
This isn't a bug, it's a failure of basic security principles. Imagine if the super to your apartment complex accidentally mailed a box full of duplicate keys to a local methadone clinic. That's not an embarrassing mistake, it's a catastrophic error bordering on criminal negligence. Drawing attention to it is meant to not only deepen the embarrassment and thus encourage fixing the underlying problem so that it never happens again but also to let other people know (such as tumblr users) about the amateurishness of the tumblr operation and finally to encourage other developers out there to avoid making the same mistakes.
Outage, singular. You are talking about the 6 hour outage, not the 6 hour outages. Reddit is prone to go down more than some other high profile sites, but you are talking about a single occurrence of it going down due to a known issue that is explained in the article this thread links to.

No, it is not a coincidence. Please don't sensationalize a comment about an article that clearly explains what went wrong. Go to Reddit for that.
I'm going to disagree with you. The problem with PHP is that there's no easy way of sharing state between requests.

If you have a separate (ini-style) configuration file, every time you get a new request, the file will have to be read in from disk and parsed. On heavily-loaded web servers this can be a significant performance issue.

Configuration stored in a PHP file will be cached by your opcode cache and so doesn't incur any per-request parsing/reading overhead.

The problem here is not that Tumblr stored their configuration in PHP. The problem is their lack of testing their changes.

(As I mentioned elsewhere in the thread, this particular nasty issue can be solved by simply enforcing that every .php file begins in '<?'.)
No problem - I appreciate the good feedback!

Finding the 'Paul-Graham-of-Knitters' for each community is exactly how I was thinking of approaching this. Getting those people to buy in to the concept will be a challenge, indeed - but not impossible.

With Reddit, the difference is in how customizable it is. You can hit "Politics" and get a list of posts loosely related to politics. But you can't get a feed specifically for "New York Politics" or better, "New York Republicans".

I may be wrong, but HN could be a business if PG wanted it to be.

We all take pride in being outliers, I agree. However would you agree that even HN has it's share of trolls? How does HN keep them out?

I believe there are people out there who take topics (of the non-technical variety) seriously enough to fight for the maintenance of their community. Hopefully I'm right!

Thanks again for the feedback.
http://www.reddit.com/r/IAmA/comments/etu2s/i_was_born_in_sh... This Reddit IAmA has the poster claiming his grandfather was pretty deeply involved in the plan. Relevant subthread: http://www.reddit.com/r/IAmA/comments/etu2s/i_was_born_in_sh...
I feel really bad for them right now, but I can't stop reading it.
By having a central config file that is included throughout the pages. Once included, it's not parsing it as PHP because it has the typo in it - thus showing it on all pages that include that file...
Vodafone Australia fail
Yes, it is that hard. I was also irritated by no link in the article.
I rarely go off like this but man, look at this PHP file!

It's a mess! Very long, not dry, no wonder the dev fat fingered it...

Is the rest of the framework like this?

No headless output testing? Manual output checking (at the least)?

For the record, as much as I hate to admit it now I was a big long time PHP developer. My code is used round the web today...
Absolutely. For someone interested enough to read a 10-page scientific article to verify a reported fact, $30 fee is usually not a big deal (plus the 5-10% of the population who are in the universities can get it for free). I am surprised the science journals themselves are not pushing for this.
Aren't all bugs effectively a human error at some level? In this case, the human wrote bad PHP.

I hope Tumblr will keep us more in the loop on this than when they were down for 24+ hours.
If the typo is in a top-level layout file or something that would happen.
Sure - I'm not defending PHP. This is all the case for backwards compatibility.

The easiest solution would be to define a new file extension/MIME type which is "PHP-by-default".
If "isn't married to any particular vertical", how is it any different from Reddit?

I mean why should I use it and not Reddit?
See also; http://news.ycombinator.com/item?id=2343330
Files outside the web root are not accessible by the user via HTTP, so I don't see the issue with that?

Unless you include it from somewhere in the web root, but that's the other insecure-by-default behaviour I was hinting at. With a secure-by-default web framework, it's not possible to get the code to show at all because it's not intermingled with the content.
Mount a temporary ram partition
"this is not what I had in mind when I said we should open source the backend"
Variant Travelling Salesman Problem solved by Sharks
I just bought the ebook version and it appears as is on the preface.

Not that I bought the book for the preface...
Don’t Bet Big. Little Bets Are The Ones That Turn Into Billion-Dollar Ideas
If your going to think about time travel and how it really works I think you will also have to simultaneously tackle the "double slit experiment" the phenomenon where a single electron exists in an infinite number of superpositions, all modifying its own existence, while coming to rest as a collapsed wave form as a single particle.

The double slit experiment proves to us that a one-universe linear view of time doesn't work. For a particle to seemingly interact with ITSELF, then go back, pick one route, and hit the wall as a particle means that quantum events seem to thumb its nose at our notion of time.

http://www.youtube.com/watch?v=DfPeprQ7oGc

If you want do some time traveling yourself, use a laser pointer and three mechanical pencil leads:

http://www.youtube.com/watch?v=UANVMIajqlA&feature=relat...
Finding the 'Paul-Graham-of-Knitters' for each community is exactly how I was thinking of approaching this. Getting those people to buy in to the concept will be a challenge

Indeed. And you are competing with the likes of StackOverflow and their millions.

With Reddit, the difference is in how customizable it is. You can hit "Politics" and get a list of posts loosely related to politics. But you can't get a feed specifically for "New York Politics" or better, "New York Republicans".

Folks can create sub-reddits as detailed as they want. Some get enough traction to survive, some don't. I still don't see how your site would be different.

I may be wrong, but HN could be a business if PG wanted it to be.

And how would you monetize it? I don't see an obvious business model.

However would you agree that even HN has it's share of trolls? How does HN keep them out?

HN has trolls, despite the fact that and PG spends a lot of time trying to cultivate the commnity. There are (all too often) posts complaining that "HN is turning into Reddit"-- which ought give one pause.

I believe there are people out there who take topics (of the non-technical variety) seriously enough to fight for the maintenance of their community.

I imagine there are. And I imagine that in a large number of cases, they've already done so. I imagine there is at least one Knitter's forum successfully meeting the needs of a large chunk of the Knitter's community. I'm not really sure there is an untapped market out there.

I don't mean to sound so negative-- but there's a difference between an application and a startup. You've written some software; I'm not sure there is a viable business model behind it, especially in competition with Reddit.
Handle responses better. One of CL's weaknesses is how annoying responses get.

I recently posted an ad in NYC and received over 80 replies. But they're all individual emails so there's no easy way to scroll through the replies in a long list like comments and pick out the 3 or 4 quality ones.