skysight-inc/HackerNews huggingface dataset:
On what basis do you say that?
I understand that view.

But I am talking specifically about something that would just dump the code of the php file to the browser.
I always use a include for any hashes or passwords in a separate file. When I started learning PHP I exposed my MySQL database password more times then I could keep track of.

It does hammer home the point of staging before deploying. Also the point of making sure you vary your passwords between sites.
Article fails to do the most basic association with the paradox.

What if the operator halts the collision when he detects said signal?
they just had a single typo i?php instead of <?php
I guess somebody's using vim
Interesting as word inside the company was that it was more Sergey and that pretty much stopped, at least outside eng, in 2008.
This is changing. Many journalists would love to share and link to their primary source documents, but don't have an easy-enough way to do it.

At DocumentCloud, we're trying to change that. Here is a list of newsrooms that use DocumentCloud to share their sources -- you'll notice most of the usual suspects in there:

http://www.documentcloud.org/public/#search/

Here's a good example of a major 5-part story that cites its sources heavily. Take a look at the source documents page, and try reading one of the articles, and clicking on the links:

http://www.lasvegassun.com/hospital-care/
Different Layouts of page in Windows Phone 7
Regarding the article, s/identity/ego/g

In buddhism, when speaking about ego and being egoless this is partly what they are talking about.

Regarding the scientist example, I think the generalization is that for good identities we need to search for meta-identities. A scientist is one. Another might be a meta-identity of being someone who can easily change point of views or identities.

For those interested in the buddhistic definition, I found the following chapter interesting, regarding why and how catering to our egos/identities/self worth may cause grief:
http://books.google.co.il/books?id=8le1syvrNZ0C&pg=PA25&...

(maybe you need to be in a certain mood to appreciate it, I don't know :)
Unless your going to a company doing something really unique or gimmicky, I think sounding very normal is appealing. Far better than getting thrust in with little to no process set up around you.
...and now, one of the most popular sites on the internet has 6-hour outages.

Coincidence?
iPhones and iPods have LCI (liquid contact indicators) built into them. It's a little white spot that turns red if exposed to moisture. Often, the LCI can be triggered for all sorts of reasons (not just dropping your phone in a puddle either, think a few drops of rain etc.)

http://support.apple.com/kb/HT3425 (applies to macs and keyboards but the same point remains)

People tend to get very hostile when there's some problem with their iPhone and get denied service due to the LCI being triggered, even if that isn't the root cause of the current problem. Hence the genius guy's surprise and over-generous response.

(Disclaimer: former Apple employee)
How The Japanese Government Manipulated Commercial Nuclear Power
Putting passwords in the php file? That's not a seasoned developer in my mind.
Radiation Network
Found a link with better formatting on twitter: https://gist.github.com/29c5c5970d1f3313abd1
It looks like they included something that when the PHP parser fails, it reveals the php code. Hence the connection protocols with username and password.

Try including the sensitive connection protocols from a non-www directory?
That's why I always git diff and run tests before committing, I do that all the time :-/
Why haven’t social recommendation services for local businesses taken off yet?
simple, ring vodafone, ask for unlock code, input code, win!

you could also read the FAQ posted to you on the forum you linked.
Can someone please explain this a little more? My basic understanding is that they incorrectly opened a PHP tag and exposed the code. If that's the case, wouldn't the page have appeared broken in development? Or have been found during testing?
Good point. Minus the keys/passwords the "harm" would be limited.
Nope, you need the users' token to perform that (given that they gave post to wall permission). However using Facebook secret key, you can ban users from using your app. But then again, you need user id.
It's needed to connect to databases with authentication. What would you suggest?
By looking at the code !quality, I wouldn't be surprised to learn that they have no tests at all.
This is a rather poor proposal. I mean it doesn't even attempt a modicum of non-bias as it doesn't even include a "disadvantages" section, which most notably holds: any leak in the membrane between soil and concrete can significantly reduce the longevity of the roofing structure, meaning property managers will inevitably be facing leakages below the top level - thus meaning the property managers would face significant problems attracting doctors offices, medical clinics and even food services places as any serious leak would be cause for closure and could incur serious expense for the property owner when they'll inevitably have to pay for lost income.

While I think this is a great idea, I'm doubtful that the advantages significantly outweigh the disadvantages.

Another notable disadvantage is that if you plan on growing anything more than grass and flowers AKA a tree, you're going to need significant soil depth in areas. This means that the building is going to have to cope with not only soil weight but of the soil becoming super-saturated with water. The drainage of the soil so as to avert too much water sitting in the soil. So on and so forth. Adding hundreds of tons of soil and water onto the roof of your building is going to put excessive demands in place and sky-rocket construction costs in your urban core. Given that many cities have a problem keeping businesses in their urban core, I don't see how making it more expensive for them would be beneficial.
Because journalists don't read primary sources. More often than not they're not even aware of them.

Here's the problem: Almost all media outlets are in crisis mode so they're cutting down on their staff, meaning that a smaller number of journalists have to write the same amount of stories as before to fill the paper (or website). There simply isn't time for proper research if you have to write five articles a day.

So many journalists resort to "borrowing" from other news sources, which in turn often have borrowed their article from somewhere else. An article may start as a published paper in Nature,which is then reported in popular science, which is then reported by Reuters, which is then reported in The Times, which is then reported in The Daily Mail.

By the time it reaches The Daily Mail it's been through so many filters of busy journalists that the meaning has often become distorted. The journalist from the Daily Mail has no idea that there even is a primary source.
Encouraging internal competition within a company has led to many disasters - Microsoft tablet vs office http://www.nytimes.com/2010/02/04/opinion/04brass.html?src=t...
and recently at Nokia http://mobilesoftware.tumblr.com/post/3565611897/what-happen...

Also, as other comments have pointed out, a lot of Google products just won't survive unless they are backed by the revenue coming from Google Search.
I think this was more of a systemic failure - the file that failed in this case was also relied upon to disable development mode/error output on production servers. I'm pretty sure my production web servers return a HTTP code 500 with no further output when they encounter an error with the php.ini-production configuration file provided in the PHP source distribution.

The hitch was of course that the file in question had a "i?php" (someone was using vi and hit i too many times?) instead of "<?php" which lead the php interpreter to output that section of code as if it were HTML. That feature is something PHP could provide an option to disable and only allow explicit echo/print/printf which should be what templating engines use.
>And what is the next best thing in your opinion?

I'll know it when I see it.

I was a daily user of Slashdot from 2001 to 2006 and then I found Reddit. I completely abandoned Slashdot less than a year later.

What could beat reddit? Well, if there was a facebook-y site which allowed me to associate with people who had my interests (rather than family, friends, and people I went to college/high school), I'd be down with that. (I love my mom, but I don't think she cares about Minecraft, old-school RPGs, French pop songs, Asa Akira, and Jules Verne novels.)

Twitter is close, but the character limit, url shorteners, and "twitter-speak" (intentional bad spelling/grammar in order to "get under the limit") just make my teeth itch.
Supply and demand is an important factor. If CN demands the services of a developer with experience in the reddit codebase at reddit and the worldwide supply of developers able and willing to supply that need is only Neil, it wouldn't be unreasonable business to give him a raise, short tenure being somewhat irrelevant if that's the situation.
Yes, of course. I said similar not identical. :)
AUTHORIZE_ID and AUTHORIZE_SECRET_KEY... anyone know if those are for Authorize.net? Yikes.
Ask HN: Why is there no down voting on HN like Reddit?
It seems a little hypocritical of Goldman to go after this guy. When a Wall Street firm is accused of doing something bad, the firms's response is along the lines of "Why not let the free market work this out and keep the government out of it?"
But you could have users log into your site and then act as tumblre. If they already OK'd the tumblr app, they would never know. Otherwise they'd just have to ignore the screen saying what App you're OKing (and most people, I'd wager, would, and just think you were using tumblr for something).

right?
I believe the way to do it "correctly" would be to put the actual file containing the credentials in a non-public location and just do an include where you need to access it. At least that's how I do it. I could be wrong...
I normally hang out on #macdev , #iphonedev, #C, etc. but you can find any language specific topic
I hope their firewalls are good because this may instigate an attack. Tumblr, 80,443,established,related accept, all else DROP.
If you have ever studied both of them, even briefly, you know Arabic is much less legible than Hebrew. It takes a lot of work even to figure out what the letters are in Arabic (they all look like parts of a doctor's signature).
Those are pay as you go services are they not? The reason they are asking for an SSN is so they can do a credit check.
A jacquesm comment led me to build HN for the rest of the world. How it works.
Xobni kept crashing on me all the time, but otherwise I would have used it. Outlook is terrible for searching/finding mail, Xonbi makes that a lot simpler.

Rapportive is good if you're frequently in contact with new people, it's great for giving you context.

When I was searching for a new flatmate being able to instantly see a potential flatmate's tweets and facebook page made it much easier to decide who I wanted to live with.

On startup mailing lists it lets me see instantly the Linkedin background of someone making a comment. I'd love to have rapportive functionality connected with something like Lanyrd to see the background of conference attendees.
25 Things I Hate About Google
Typically, these files are not web accessible. Problem solved.
Firewalls have got nothing on exposed API keys.
one problem is that because you use transparent overlays for the circles, and also colour coding (darker circles are higher values) you get a misleading appearance in heavily sampled areas (which appear darkly coloured just because they have many readings).

i'd suggest making the circles opaque (i know it's not going to look as nice, but it will be more useful...)
Trues....
Chinese Symbol Studio – Design Translation Software
Chinese Symbol Studio is a tool which helps you to translate and generate Chinese writing symbols .These symbols are called as Kanji in Chinese language.
Client SSL certificates? I don't know what DB they're using, but at least Postgres and MySQL support certificate-based auth.
Self-driving cars would count as very "startup" like in my book, especially if they make it a developer platform.
Whilst I hope tumblr correct the problem rather quickly as it is a major problem, I find those jumping to blame are forgetting one small problem. No programmer is perfect, typos are easy to mistake on any keyboard and it will happen to everyone no matter how much of a ‘ninja rockstar poodle’ they think they are.

I hate to see someone else work in the clear like this. It’s like popping a zit before your first date. It’s painful and will show up for day/s afterwards. Now I know what will be today’s headline I can bypass techmeme.

Yes its a big boo boo. It’s a massive security risk and to some it may feel like the end of the world but by then it will be tomorrow. Passwords will be reset, keys will be replaced and the valley will be talking about something else. Hopefully it won’t be someone else’s mistake.

P.S Don’t forget to test your code before deploying – now you know why.
If you're doing an include, wouldn't the passwords still be in a PHP file?
Free Lara Dutta Hot Wallpapers, Lara Dutta Sexy Photos, Lara Dutta Hot Pictures
In former astronaut Mike Mullane's book Riding Rockets he details how some of the Challenger's controls had been moved from their standard launch positions. NASA tests would later confirm that they could not have been moved by the force of the initial explosion nor the impact with the ocean.

At least some of the Challener crew survived the blast, and died in panic.
In the sciences, most of the primary sources are closed, and so linking wouldn't be too helpful. The material also tends to be so technical that only experts in the field can read it.

As for that class of secondary sources (e.g. review articles and editorials) that is provided for free in a dumbed-down form, then, yes, journalists should provide links.

A custom of providing links would be very helpful in the "chat about science" writing industry, so much of which is based on opinion and political view.
I think one of the main reasons may be that a lot of what appears to be journalism actually isn't - it's press releases from various companies and organisations, known as "churnalism". It's surprisingly easy to find churnalism, even in what appear to be fairly authoritative news sources (see churnalism.com). If journalists routinely cited their sources they would have to admit that often large sections have been copied verbatim from the public relations output of companies.
And this is the reason one should separate production and development environments and NEVER edit any files on production servers (let `git push` or something similiar handle it)
To keep the trolls and Debbie Downers out.
This is very true. In this case the obvious choice is to create new keys although how inconvenient it will be I dont know.
If you can send a signal then it's reasonable that you can send a signal that represents a person.

It's just a small extra step to reanimate a person based on communicating their waveform to the past. Look out for Prestige-style problems though. /sarcasm
if the php file is printed rather than executed, the include will not be followed.
You'd see the "include /path/to/inaccessible/file" but you wouldn't see the passwords within the include.

I think. I haven't seriously used php since 2003 or so.
Hotot: A Promising Desktop Twitter Client
That wouldn't help in this case, since a typo in the config file is making the file not be parsed as PHP.

If you want to avoid that possibility, you can use a non-PHP format (eg: YAML) and parse it.
Thanks jacquesm for showing us that it is possible to be content without being complacent, to persuade without proselytizing, to educate without ego obstructions.

My praise would probably be over the top were OP a standalone post, but I reckon it deserves that recognition given the contrast in tone with the posts it references. Hopefully OP inspires more rationality (http://lesswrong.com/lw/31/what_do_we_mean_by_rationality/) and balanced writing in submissions/comments.
the attacker left their IP address in the dump, and their LAN interface address

Edit: it's whoever dumped this as opposed to an attacker

I don't think tumblr have acted on this yet. The other exposed pages have S3 API secret keys, facebook api secret keys, the username and passwords for vimeo, clickatell (whatever that is), twitter oauth secret key, etc. they are going to have to revoke and re-setup each of these.
Yes one server, but that isn't entirely fair because pg has Robert Morris to tweak it.

And he is a kick ass sysadmin.
If one would made a similar typo in that file, its contents will be displayed too.

A solution would be to have a .ini-like (or some other simple-to-parse format) config file and PHP code to read its contents. PHP code could be leaked, but config file contents wouldn't.
A huge mistake, but Tumblr's staff are probably quite experienced, nonetheless.

How about that gotcha though? A single character is mistakenly changed from "<" to "i" and that exposes the source code to the browser. Think about that.
How is a client certificate different from a long random password? Both have to be stored somewhere. The correct solution is to keep this (and everything else) out of your web root.

If that i?php blunder happened to me, my users would see 10 lines of code. One include for the framework (which lives outside the web root), plus three calls to get the framework to handle the current request.

Those 10 lines would be totally unproblematic
Just put: display_errors = Off is your php.ini and you will never see any errors. This is recommended everywhere for a PHP deployment.

; This directive controls whether or not and where PHP will output errors,
; notices and warnings too. Error output is very useful during development, but
; it could be very dangerous in production environments. Depending on the code
; which is triggering the error, sensitive information could potentially leak
; out of your application such as database usernames and passwords or worse.
; It's recommended that errors be logged on production servers rather than
; having the errors sent to STDOUT.
; Possible Values:
; Off = Do not display any errors
; stderr = Display errors to STDERR (affects only CGI/CLI binaries!)
; On or stdout = Display errors to STDOUT
; Default Value: On
; Development Value: On
; Production Value: Off
; http://php.net/display-errors
display_errors = Off
.pem file won't be leaked in this ("i?php") manner. Only file's location would be revealed.

Of course, you are completely right, it should still be inaccessible from the web.
It doesn't really look like there was any attack. One of the developers made a mistake with the PHP opening tag in the config file. Anyone visiting the page would have seen this output.
There is a basic problem with many of these ideas. Current research in education is showing that technology alone is not enough enhance student learning. In other words, putting a computer, device, method or software in a classroom adds nothing to test scores or student outcomes. (As a time saver, I'll let you Google up the citations). We have learned this far too late in education, having spent billions and billions in this area with virtually no return in concrete results. The trend is to use these things as fancy drawing and typing and adding gizmos that simply replace pens and paper: a waste of potential.

It is also true that teachers don't want to mess with more of this stuff. We are already beat over the head on a regular bases with the latest and greatest methodologies, books, ideas, etc. on a regular basis. Ask any experienced teacher about their faculty development meetings and they will just laugh and tell you about the last 30 years of innovations that were supposed to have changed education.

Here is what someone needs to do in my opinion. Ideas should include LONG TERM training (2-3 years) that is mandatory in their sales package, back it up with solid research, and provide a payment model similar to a lease or student pay-to-play (where you aren't hoping their newest principal or school board also likes the idea the previous group did). In other words, PROVE it works, teach teachers how to use it, and give schools a realistic way to pay for it over a period of years. If not, you're just another one of the 40-50 "latest and greatest" idea I've seen come and go over the decades.

Good luck.
Great Not big.
Strangely, you seem to think Xbox trying to conquer the living room without bothering to include a browser supports your case that Microsoft loves the web, but just consistently runs out of money across its various products before getting around to supporting it properly, whereas I would have had that right up there with the lack of spellchecking in IE as a clear example of Microsoft quietly hoping the web will go away if they ignore it long enough.

I'm not asking or expecting them to support everything and anything with their minuscule bank account and negligible market power. I'm just pointing out that the web is kryptonite to Microsoft and their PR to the contrary is laughable. If you want to believe it's simply mismanagement on a massive scale that leads them to fail at the web year after year then good for you, but I personally think it's just smart self-interest on their part.
How can you look at this code and make any statement about general code quality? The stuff that was exposed was pure initialization code that would look the same anywhere you look.

Granted. This should move outside of the web root, but just looking at this one file that just sets up configuration values provides no ground to say anything about general code quality
I think a journalist from the Daily Mail probably has no idea what a primary source even is.
You were trying to make a clever point about the realities of the workplace and I think it's valid. No matter what you are doing with your life your job is to sell yourself... And I get that... and I think most people here get that. But it's not especially relevant to the topic at hand and just makes you seem like a smartass.

I write software for a living. My job definitely hinges on selling myself... But it's fair to say it's nothing like a traditional retail workplace...
Awesome article :) Very well written
Appendix F is a must read. The tl;dr summary is:

Engineers at Rocketdyne, the manufacturer, estimate the total probability [of catastrophic failure] as 1/10,000. Engineers at Marshal estimate it as 1/300, while NASA management, to whom these engineers report, claims it is 1/100,000. An independent engineer consulting for NASA thought 1 or 2 per 100 a reasonable estimate.

— Personal observations on the reliability of the Shuttle by R.P. Feynman

Empirical post script (as of STS-133 24 February 2011)

Total launches	132
Failures	2
Successes	130
Failure rate:	1.5%

Edit: add opinions:

See also http://en.wikipedia.org/wiki/Rogers_Commission_Report#Role_o...

The reason for appalling and wildly inaccurate estimate of the failure probability is because the failure probability was a top-down "estimate." Someone Important apparently said "the space shuttle needs a reliability of 1/100,000". This mandate was pushed down on all the suppliers. The result was that the probability of failure was divided out onto all the systems, subsystems, subsubsystems... ad nausium all the way down to the bolts. The result was that all the subsystems had reliability numbers that could not be refuted (e.g. bolts at 1/10^12 IIRC), but could not be realistically substantiated either. Unfortunately, some of the probabilities of the major subsystems (SRB and ice damaging the heat shield tiles) were not accurate. The most accurate estimate was the engineer with a lot of experience in extremely complicated systems who gave an experience-based estimate, not a top-down (dictated) numerically derived estimate.