skysight-inc/HackerNews huggingface dataset:
HELP! I don't 'get it'!

Looking at that list of SQL injection attack techniques, I don't see the threat.

Or: Yes, I'm building a Web site, and the server will be running SQL Server.

Some of my Web pages have users enter data in text boxes. So, they could enter a SQL command in a text box.

Then when the Web page is returned to my Web server as a 'post back', my software reads the data in the text boxes.

I have the page built, have code for extracting the data from the text boxes and putting it in, say, string variables in Visual Basic .NET, and now am writing the code for looking at the data in the strings from the text boxes.

So far, I see no threat.

So, I intend to look at the data in the strings and see if it looks anything like a SQL command. Anything that looks like a SQL command will get rejected as bad data and not get near my SQL Server database. Maybe I will write the bad data to my log file.

So, I'm checking the input data from the users. I am assuming that the input data could be anything at all until my code establishes otherwise.

Doesn't everyone do such checking?

With such checking, where is the threat of 'SQL injection'?

If SQL injection is a threat, then why? Just from people not checking input data from users? Some other reason?
Learn How to Lose Weight and Earn Money at the Same Time
Philosophy of a video game reviewer. | Lazy Ass Gamer
"only"? $1,000,000,000,000 is a lot of money, even in the context of $14,300,000,000,000. Also, do you have a source for that $1 trillion figure? I think it's higher than that.

Not to change the debate, but if Obama really cared about saving money he not only would have ended the wars in 2009 but also cut military spending significantly - we could keep the largest military in the world and still cut its spending by $3 or $4 hundred billion. (http://en.wikipedia.org/wiki/List_of_countries_by_military_e...)
A billion dollars ain't what it used to be... With inflation, this bar has been dropping over the years.
I'm not sure about Stanford, but much of the information that MIT would impart is available on-line for free. Cherry-pick the course offerings and fold them into what ever program you are currently attending. Ultimately none of the 'paper' will keep your job even though in those shallow circumstances it may get you a job. What you know and what you learn combined with what you make will be the key in your continuation as a developer. Think of it this way, it is almost a cliche that there are two ways into a job---one through the front door through HR and one through the backdoor through the people who you will actual work with. The second group seldom gives a damn about 'paper'---you take it from there :) @TrevorBurnham---I remember Carleton fondly although it was damn cold in the winter. Likewise certain people took a really dim view to physical contact in the common area when I came for a visit :)
The second blog post (linked above/below) is the problem. Before that, I thought this was a major crisis, but could be survived. After that (and the FT article), I really think they will be incredibly lucky to survive, much less continue their growth trajectory.

People who use startups early do so because of the human interactions. AirBnB destroyed that by not being humane with the woman (EJ?). Sure, she has culpability, but I guarantee making her "right" would have cost one or two orders of magnitude less than this is costing.

I would also expect the board to replace the CEO as a symbolic gesture. Somebody has to take the blame or they will not be able to get the next round raised.
Some aging statistical research shows that if you have a bad experience you'll share it with 26 other people; having a good experience nets only 13 people. Multiply that by the internet and predict the market effects.

As disastrous as this is to EJ and her life, I think it'll be the utter ruin of AirBnB.
This is a 37 year old woman who lived in NYC for 6 years and then spent two year traveling to places like Brazil and Bogota, Columbia. At this point she knows that people suck and shit happens. She definitely does not have PTSD from this experience. I take back any thing that might have suggested I agreed with the conspiracy theorists. This woman is BROKE and she's trying to spin this hard to get some sort of payout from AirBNB.
"I don't really see why it should be illegal for them to include some extra numbers,"

For "extra numbers", substitute "lies with statistics", and it'll become clear. This application isn't the place to give the company a free-form field to put its propaganda in.
That's not what I meant. What I wanted to say is you put so much effort to master Vim/Emacs (as you want) so if you say "oh great a new editor i'll use it" all the efforts spent in learning Vim/Emacs are "lost".

I hope you get my point!

(and I agree that they have qualities that other editors don't match)
http://www.whitehouse.gov/infographics/us-national-debt provides an interesting alternate take. Rather than chart by when the debt arrived, it charts by which policies caused the debt.
The method I am about to mention here is based on that which was outlined earlier by somebody else [1]. As I will mention further down, the method I suggest here will give the administrator and the CEO the opportunity to conspire and retrieve users passwords without the affected users knowledge, but I will here assume that such could not happend and that if they really wanted to do so, they could find other means anyway (keylogging, etc.)

First time: On his client, the user is asked to enter a password which is checked to comply with password rules. This password is salted and hashed before it is stored on a central machine.

n-th time: On his client, the user first enters password "n - 1" which is then salted and hashed and sent to the central machine for comparison. If hashes match, you may enter the new password "n" which is checked to comply with password rules.

Password "n - 1" is then encryted with password "n" and stored on the central machine. Password "n" is stored on the central machine in two forms:

1) Salted and hashed.

2) Encrypted with a public key.

Password "n" is encrypted with a public key and stored on a he central machine. Also, when this machine stores the new public key encrypted password, it deletes its own records of any previous public key encrypted password for the user in question.

Through recursion, all old passwords ("n - 2" ... "1") are decrypted and the new password is checked so that it does not match any previous password and that it is not a simple permutation of any of those.

If the user forgets his password, the administrator physically logs into a machine which is very tightly secured. This machine does not allow inbound connections of any kind over the network and can only make outbound connections to the central storage machine. Furthermore, the machine does not allow the usage of any removable media (CD, DVD, USB stick, etc.). The drives of the machine in strongly encrypted, as is the private key which is stored on this machine. In order to decrypt the disc of the machine, two passwords are needed. One of the passwords is held by the administrator, the other by the CEO of the company. The same goes for the private key which also has two passwords, both of which are needed to decrypt it. Thus, two people must be involved in order to decrypt the password for a user. Once the administrator and the CEO has logged into the machine, they connect to the central storage and retrieve the encrypted key for the user and then they open their shared private key and decrypt the password. After the user has been given his old password, he must create a new password following the procedure described above. That way, the administator and the CEO does not know the users new password (unless they conspire to do so, but that would be breach of trust).

http://news.ycombinator.com/item?id=2820976
Story sourced from CNBC, submitted here:

http://news.ycombinator.com/item?id=2813186
> "Why aren't the wars mentioned under Obama as well?"

For the same reason that Reagan's tax cuts aren't mentioned under every subsequent administration. When you chart a timeline of policy changes, it's implied that the responsibility for continuing those policies is inherited by each subsequent administration until a reversal (if any).
Seems like a great idea. This way, developers can decide if they need eval and make the tradeoff. Note that eval can also be use for metaprogramming, and that not having the full code of clojure also affects runtime reflection.

Which is more to the spirit of Clojure and LISPs in general: developers being able at any momemnt to change the language as if he was the language designer.

Or, as said on Five Questions about Language Design[1]: Give the Programmer as Much Control as Possible

[1] http://www.paulgraham.com/langdes.html
This is the same problem that has plagued Windows on PC for years before this. Buying a PC from Dell or any other large retailers with Windows pre-installed meant a day worth of removing their crap-ware, support software, and back-up suits. Or you could reformat straight out of the box.

Only this time the problem is more perwasive. With PC an average user did not get botherd by all this trash, the machine was good enough for surfing and email, which is what they used it for. Only advanced users and techies would get frustrated. However, with smartphones it seems to be a real problem even for an everyday user.

What I don't understand though, is all this fat that providers pile on the phones and PC really worth it for them. They spend time and money to develop all these custom themes and apps, than users remove them. Even if users don't remove them and find them good enough to use, where is the profit to the provider? Branding and recognition?
I really, really enjoy working w/ this template engine.

If you are using rails and are accustomed to using jade for templating, or the jade-style flavor of scalate, this is the template engine for you.
> Think we need a new super post that just allows everyone to post articles on who's responsible for the US debt underneath.

How about this as an alternative suggestion: we keep politics off of HN?
I think it makes a lot of sense for the document databases. It would make much less sense applied to something like Redis though.
Can Positive Thinking Be Negative?
3 Ways to win like Chris Brogan
The origins of craigslist and how it was an accidental success
I'm not saying it's right or fair. I also think it's nonsense. You're thinking on the side of a smart entrepreneur, not a criminal.

All a crook is interested in is hearing or seeing the headline: "Airbnb pays for loss and damages to rattled user", or other more clever narrative. If you're a criminal, details aside, you've got all you need to scheme up an assalt.

Criminals don't work on high probability, if they did, there wouldn't be so many obvious ones. Just because they aren't likely to get the reward they desire doesn't mean they won't try.
I agree with you completely when u say that passion is necessary. However, I plan on being able to start living from my own work sometime in the next 10 years and that's why thinking about money is somewhat important even in the beginning.

I would like to be able to work with a small (and cheap like you said) application but even though "small" apps in the web that are making money (basecamp? fogbugz? and others...) are not that small and simple.

Unfortunately I'm really not into games (no passion here, see? :) ) so a LOB app is more like something I would go for.
This piece can't even keep Borders (bankrupt, liquidating) straight from Barnes & Noble (burgeoning digital business). Original reporting here from BGR:

http://www.bgr.com/2011/07/28/does-apple-have-any-interest-i...
or, Why i got a non-subsided android phone and kept it.

yeah, it's bad to have some of my options crippled by bloatware. but i can still choose to avoid those. and still plenty of choices, with different screen sizes, batteries, prices, keyboards or not, etc.

iphone has lessbloatware, but no choices.
You're being voted down (not by me, mind you) as it can be interpreted as a defense of the indefensible.

Even with the charitable interpretation of "this guy doesn't know what plaintext means", the overall conclusion "this guy doesn't know what he's doing and is downright dangerous" still stands.
SQL is a fantastic set based language. Using SQL to query MongoDB would be about 7 steps forward for just about everything I do, particularly if "SQL" magically included joins.
3 Ways to win like Gary Vaynerchuck
"Industrial farming based on huge amounts of cheap oil is not sustainable either. Think about all the oil/gas used in fertilizer production, pesticides, mechanization, harvesting, processing, storage, trucking, packaging."

Believe me, farmers think about that subject far more than you can imagine. They do everything they can to reduce the number of passes they have to make through each row of crops.

Farms like my in-laws leverage technology to the maximum. For example, they have GPS units on their tractors that are integrated with meters that track how much fertilizer is being distributed and they've been tracking this for almost a decade. When they harvest, they have GPS units on the combines and sensors that are tracking yields. At the end of every season they use 2D and sometimes 3D modeling to determine the optimum distribution of fertilizer down to a few feet. The off-season is dedicated to crunching these numbers, plus a mountain of other data that is collected. The goal is to absolutely maximize the efficiency of resource use: fuel, fertilizer, pesticides, etc.

When it comes to the question of sustainability you've got to remember that many if not most farms are generational. Fathers passed the farm to the current generation, they hope to pass it to their sons or daughters. They are far more invested in the economic and environmental sustainability of their operations than the folks that have made sustainability a trendy buzzword.

And understand that I am talking about industrial farms. There is no true distinction between the "industrial farm" and the "family farm." They are one and the same, but there is a lobby out there that has it out for agriculture. You sound like a real jerkoff if you're attacking the "family" farm, but if you use the word "industrial", you conjure images of smokestacks belching pollution and fat white guys in suits lighting Cubans with the money they stole from the pocket of the janitor. It's totally cool to attack those guys.

Think about it this way. Where I live it takes about 1,500 acres to support a family. Let's say you have three families working a farm, a father and his two married sons and their kids. That's three families that need about 4,500 acres to make a living. That is a lot of land and it requires an industrial, in the dictionary sense of the word, operation to farm.
>I installed CM7 stable, she gets push updates that are seamlessly handled via Rom Manager.

Does this work for major updates? As far as I know when you want to move between major versions (the next one is 7->7.1) you have to basically wipe the phone and start from scratch. Because most Android apps use local storage that isn't synced to the cloud, to actually keep your data you'll have to use hacky things like Titanium Backup that may or may not corrupt data, particularly so for system settings.

The biggest shortcoming I see in CM is this, the lack of a good Over The Air upgrade method that keeps your data. Ideally I'd like to see Google offer APIs to apps so that their data is continuously synced to my google account and then upgrading or getting a new phone would just be a matter of logging in and letting it sync for a while, making it closer to a ChromeOS experience.
Pretty sure that was a joke regarding his personal aversion to zucchini.
I know i'm making a glib comment on an extremely complicated issue, but i really wish i could just raise my own credit limit over and over again in order to keep a good credit rating.
Δωρα
Χαρίστε Δώρα Εμπειρίας Days4u - τα πιο πρωτότυπα δώρα που κάνατε ποτέ! Οδήγηση rally, μασάζ και ημέρες spa, βόλτα με αεροπλάνο και αμέτρητες άλλες ιδέες για δώρα!
The onus here is on Google. They are going to have to more rigorously enforce their platform or it will become useless. Say what you want about iOS, but I know exactly what to expect when I use or develop for it. That makes my life much easier. Android in its best case can be fantastic, but the problem is that there are many cases that are far from best case. I am hesitant to develop for Android due to this.
> You lack the breadth of experience to make this claim.

Wake up. You're 23. You're a kid. You've just started programming and think you know everything. You don't.
Obama has wound down the Iraq war and is planning to wind down Afghanistan; the Reid spending-cut proposal takes these into account when projecting how spending can be reduced over the next decade.
What makes the fuel go boom? Turbulence
where are the wireles data provider start ups?
PhoneGap 1.0 Launches Today
I'd say forward for sure. This breaks down the barriers to entry for a lot of folks, especially in enterprise land. Definitely looking forward to how this develops.
What will happen to the American if the congress does not vote on the rise ?
I think laptop OEMs got kickbacks for bundling crapware, especially antivirus software. I imagine the same is true of those mobile phones that bundle, say, Amazon.
Samsung to launch White Galaxy S II?
In 2009 I wrote in "The Dark Side of NoSQL" (1) about problems with NoSQL:

"1. ad hoc data fixing
– either no query language available or no skills
2. ad hoc reporting
– either no query language available or no in-house skills"

(1) http://codemonkeyism.com/dark-side-nosql/
I might suggest that the password pattern strings are encrypted using a key based on the user's password plus salt. This way, the password pattern list is only recoverable AFTER recovering the users password (via brute force). I think this solves the reduced search space problem of your scheme.
It's not that the military spending is good for the economy overall, but rather that it's good for a large group of very powerful people who wield far more influence than any one president.
Even worse, Cincinnati Bell charges 25c for incoming texts (if your plan doesn't include them), but then charges you $3 a month to block incoming text messages altogether! I've long since switched back to T-Mobile, and regretted ever moving away from T-Mobile in the first place, but my parents have decided to put up with the stupid 25c charges for spam texts because it's still cheaper than paying a monthly fee for what used to be a free "service" of flipping a switch in their database.
I studied in Valparaiso and Vina del Mar - both very nice places on the beach about 1.5 hours from Santiago. It's a pretty modern place with all the shopping of a city of 200K in the US.
Immediately below the report preview images:

Note: Billion Dollar U.S. Disaster costs have now been adjusted to 2011 dollars using the Consumer Price Index (CPI), as noted below.
Not sure what the OP was talking about, but I won't touch them because they're completely lacking in flavor!
France does not have area codes, just so you know. The second digit (French phone numbers have 10 digits, and the first one has to be 0) is kinda-sorta related to a broad geographical area for some (1 is Ile de France, 2 is the north-west, 3 is the north-east, 4 is the south-east and 5 is the south-west), but not all (6 and 7 are mobile phones, 8 is free and shared-cost services and 9 is for VOIP and stuff which does not fit in the previous numbers)

edit: and the grouping is as simple as you can do: digits are written in 5 groups of 2 digits.
While I'd like a mechanical solution, I think the best results are probably going to come from human intervention/interaction.
How about health care, in terms of cost and quality?
If you want better cellphones with better carriers who don't do stupidly intrusive things, move to Europe.

That's practical advice, but I still haven't unpacked after moving to Canada to get affordable medical care.
London area code is 020, so I'd bet on "079 20748555".

If a website validates those two-box input fields, then surely it knows length of the prefix better than I do.
U.S. House Judiciary Committee approves new ISP data retention bill
Since the financial state of the country lies firmly in the hands of congress, maybe what they should do is get off of there posteriors and take care of business. They look funny on the floor rolling about and screaming---as they have since election. And George Wills has the temerity to accuse Obama of throwing a tantrum---perhaps the overload of such behavior has broken his ability to distinguish.
> He does have a magic wand, in the form of a pen that he can use to veto new military spending. He hasn't used it.

There's no such thing as a line-item veto. So, it's not that simple. But he's commander in chief and could just order the troops home, which I think he should do by early next year and make the Republicans howl about it in between howling about spending. Not that cognitive dissonance has stopped them so far.
This is such a tragic situation. I am shocked by the lack of response by Airbnb. The very least they can do is provide her assistance and connecting her with the right resources to move forward.

When I was in college, a classmate in a philosophy class found out I was a business major and turned to me and said "you guys are just so heartless." I resented the statement but brushed it off as a gross generalization. Situations like these just prove my classmates point to be more real than I was willing to admit at the time. Putting profit above the safety and well being of your customers/users is a terrible business practice that will certainly lead to the death of your business. This isn't even about PR, this is fundamental to the future of the Airbnb platform and they aren't even listening.

The hotel lobby has a huge opportunity here that I don't think they realize yet. With this being on the front page of the Financial Times today, the hotel lobby should be swooping in anytime to pick up the pieces of Airbnb's failure to act. If I were the manager of any hotel in the SF area, I'd be offering her a free stay until things got sorted out. Airbnb is going to be left in the wake wondering what the hell happened.
At least circuses have low potential for fraud -- nobody gets eaten by a lion just for the cash. If airbnb started insuring (directly or indirectly) against damage caused by renters then there's quite a few ways for unscrupulous folks to try to rip that off.
Can't wait to see what iBama will look like :)
Email is not a reliable way of communication anymore, because of the spammers. I have given up on checking my spam folder, which means there is a probability of ham getting lost.
I'm not saying it's not possible but it is expensive (high risk = high cost). What's AirBNB's margin? They charge 10% but after expenses, can they make money paying the insurer X%? That's the fundamental question and I suspect it's "No".
London is one of the few exceptions, not the rule. And even with the three digits, most Londonders I know split their phone number differently (for example "0208 XXX XXXX").
Ah, the News of The World defense.
It's more of a statement about the culture and expectations growing up around Android, than about Android the technical artifact.

The technophiles are right about the point they make about the latter, but it's the former that will make or break it in the marketplace.