skysight-inc/HackerNews huggingface dataset:
Interesting. I work with Rails every day. I understand and explain the source of the bug, and why it has nothing to do with some oversight by Rails. I'm downvoted.

Every other answer, often admittedly, is written by someone who doesn't know anything about Rails, but jumps on the "oh geez Rails has a terrible security hole" bandwagon.

What has happened to this place?
> while Groovy for quick scripts to test stuff.

I doubt groovy would be listed in job ads just for scripting.

Grails has pretty significant adoption, both among startups, and to a larger extend among the enterprises, e.g. Java Shops.

This is a great summary of the sate of the Groovy / Grails ecosystem: http://burtbeckwith.com/blog/?p=1126

I am curious with Grails 2.0 out for a few months now, and Groovy itself nearing 2.0, whether the adoption will reach an inflection point (and I do anecdotally see more activity of late).

Knowing both (though much heavier experience with Grails), I don't see significant differences in productivity between the two.

For the Java shops, Grails vs Rails, is not really a contest - Grails should win on pure technical merits, although of course it not always does for other reasons.
Misys targeted by CVC and ValueAct in new bid
Home | Tutors in San Diego | San Diego Tutoring
When the instant service of home tutoring available at your ease, why the hell one will waste his time and waste his money on travel finding tutor service offices from here to there? So, the opportunities to protect your money and time with tiredness have gone away with tutortutor.org.
The former submission with links to other Portal mashups: http://news.ycombinator.com/item?id=2939097

Not played Mari0 yet, but I loved Not Tetris from the same authors.
While there are many corner cases which you have outlined, in the grand scheme of things job advert data is a reasonable indicator (and one of the few we have). In the case of languages with limited commercial adoption (Clojure, Haskell) there will be more noise due to the small sample size and low adoption. The indeed.com data indicates that Java and C# are popular languages. Do you believe that to not be an accurate reflection of reality?

What is interesting about the blog is that it also correlates the results with results from polls among developers.
I'm just noticing, reading this, that I find "get out of my face with indeed.com" to be more offensive than if you said, "screw indeed.com", even though the former seems less dirty. Language is a funny thing!
Why Early Stage Startups Should Not Exhibit at Conferences
Very cool, but the most useful thing to me about Rubular (which this is inspired by) was the quick reference. Considering the results you get for a google search on "JavaScript Regex", a nice simple table with the basic syntax (and methods) would be very valuable. After that, the fact I can test expressions on the page is just gravy. I can test expressions on any page in the world with Dev Tools.
Principles of Effective Logo Design
AUO lands panel orders for Apple 7.85-inch iPads, says paper
Thanks badboy! The editor was definitely the most fun part to write (but it need more love, there are a few bugs). Since the whole editor only uses setPixel() as basic primitive it will work the same in different operating systems that can be a good point. Probably could be easily extrapolated to be used into games for the same reasons.
The poll results indicate that on the JVM JRuby trails Scala, Groovy and Clojure significantly. The indeed.com discussion probably excludes JRuby for the reasons you mention.
This is one of the most careless mistakes devs make especially those not so experienced with security. Not without a reason it is there in the fourth spot of OWASP top ten: https://www.owasp.org/index.php/Top_10_2010-A4

I really love Github and have been trying to get it adopted in my organization. After the recent events though I'm having second thoughts. I don't think any application is 100% fool proof. But a well known vulnerability; one that is always brought up in any audit, going unnoticed for so long? I honestly did not expect this from Github.
Why do you need a good web design?
At Infilon, we provide powerful Ecommerce solutions that make you stand out of the competition. We convert your dreams into reality. Whether you are looking to sell five products online or five thousand, we can help you generate ROI effectively.
Save £1000's
Even more funny, for the fact that Hollywood was originally built in order to pirate Edison's patents...
https://en.wikipedia.org/wiki/Motion_Picture_Patents_Company...
CS courses tend to explain what bit shifting is but not when you would use it.

For example you'll often see a lecturer drawing lots of 1s and 0s on a whiteboard to illustrate it but you're less likely to see a simple example Java program which uses shifting to get RGB values deconstructed.
Can you please allow us to get a sample of what we're going to get before we have to enroll.
Post-Apocalyptic Zombie Revolution - Applications Welcome
West London Escort
That is why we are proud to offer our respected customers a beautiful selection of ladies to join them for some fun in the city.
You're snarky, but that's exactly the way we used to protect source code intellectual property here in Uruguay until recently.

Nowadays you can hand a CD, plus a printed manual. Printing the code is now optional. But you still have to register every version :)

http://www.cuti.org.uy/registro-de-software.html
I hope there are simple ways to disable these on browsers.

Can't imagine every tab having a load of workers in the background, ending well.

One of the pleasant things about javascript is that there are no threads. It's a shame some people have pushed for this API.

After all, it's not rocket science for a competent developer to split a long running task into chunks which are periodically run via a timeout, keeping the UI responsive.
I thought you were able to control Mario more while he was in the air than you seem to be able to in this rendition.
Offshore Software Outsourcing
Wast experience with offshore development and also Microsoft Gold Certified partner is examples of the pointed out characteristic regarding this kind of business. They have got a hundred additionally Pleased consumers inside last a decade as well as continue to raising.
This Week in Location Based Marketing #67: Location-connected radio + Yelp IPO
How to extract text from image or PDF files
"But thats exactly why I left you that note. Because it frightens me just how insecure your house is. I care about you and don't want to see you hurt. I did it as a last resort, I tried to inform you but you clearly didn't take me seriously.

Empathy was casusing me pain everytime I saw you 'lock' your door with that elastic band. Attention seeking or malicious behaviour would have been to break into all the insecure doors on the street.

I broke into yours, so you would take security seriously, because I care about you and your wellbeing."
FlashJS - opensource HTML5 game engine with API similar to Flash one
Concrete stamping louisville
All Concrete Resurfacing 502-241-2040 in Louisville, KY offers decorative concrete design for residential & commercial, indoor & outdoor areas. We repair & install Sundek acrylic cement coatings, acid stain, stamped concrete overlays & other products on top of existing concrete surfaces. Common installation areas include: patios, pool decks, driveways, basement & garage floors.
Add to that my non-native-speaker-ness ... I will watch my language better in the future. But actually "screw indeed" would have been wrong: there is nothing wrong with indeed: they just aggregate job openings.
very easy way
I just discovered this trick yesterday, and thought it was so awesome I had to write about it. Truly decentralized code sharing! :-)
Peak Climbing in Nepal 
Peak climbing expedition is usually both technically and physically very challenging activity. Enjoy Peak climbing adventure with Snowy Horizon Treks.
Free Desktop Free Download Field Of Flower Background Pictures Collections
But the thing here is that if he genuinely wanted to retain unauthorized access, he had at the very least several days to create a ton of alternative accounts to make use of this exploit with.

Suspending his account wouldn't have affected him if he was being black hat about this. A suspension in this case serves pretty much no purpose other than to make Github feel better about themselves.
Mobile web apps should work in more places than safari on the iPhone. Otherwise call it a "mobile safari app".

I tried the app in mobile Firefox, no luck. I tried it mobile Opera, no go. Also, I don't understand why anyone would use Apple's native interface graphics on purpose for a web app. I get why native dev it makes things easier to build than custom icons etc, but on the web, you are not on Apple's leash no more, be free!
I think that with a relatively cheap kit, one do many EE lab experiments at home. witness the arduino movement.
Bootszubehör in Switzerland| Seilerei
Bootszubehör, Schäkel, Seile, Seilerei
Has potential on the Raspberry Pi.
It all depends on your expectations. Your mismatched expectations led you to an overgeneralized blanket statement. Smaller conferences with a core, focused audience would be better suited to small 3-man startups.
Unlimited calling plans, rates, free phone apps, cheapest international call app
International long distance low cost calling plans, phone call apps and making the cheapest telephone calls with no roaming charge. Cheap overseas rates for unlimited mobile calling from the USA. Free online wifi android app.
Nike Free 3.0 V2 Womens: Cheap Nike Free 3.0 V2 Womens On Sale,Discount 52% Off
Hot sale cheap nike free 3.0 V2 Womens, high quality and fast delivery. You could 52% off discount in our store. Welcome to order it.
> If anyone should be getting flamed for this, it should be the Rails maintainers that weren't open to the discussion.

A bad workman always blames his tools.
Sounds like that is an opportunity to develop a card reader that can be tethered via a secure bluetooth connection. Any thoughts?
That's my target, I hope that when the Raspberry PI will be available enough, Codakido will be functional enough to be a good alternative to the BBC micro BASIC.
The big three are Java, C# and C(++). But I do not need to go to indeed to know that.

Indeed is used often to show that language a has more adoption than language b. a and b being languages in the non- or pre-commercial domain. I'm only arguing that statements like "haskell overtakes prolog, statical typing > declarative programming" cannot be inferred from indeed data.

As for the "reasonable indicator": if the average java/php job points out that "haskell/erlang/prolog is a pre" , job ads might only be a reasonable indicator for the languages we already know to be at the top.
Citizen Aqualand
Almost every citizen watches include eco-drive technology in their watches. This Eco-drive technology of this watch make free you from the replace or recharge the battery of citizen eco drive watch.
The use of the embedded Git binary is optional though; you can configure SourceTree to use the system installation of Git.
Perhaps they mean WebKit. Oh wait, that's not just Android.

They don't even spell the name of their own stats package right in the article: StartCounter? StatCounter?

Also, anything called Phandroid is likely to be slightly biased.
I'd prefer it not to scrape stdout from a a git binary at all, but rather a use a real library with well defined interfaces.
Just to kickstart discussion (because it's an important topic)...

Common objection: using js for crypto (like cryptocat) is inherently flawed as you have to trust the server to send the right js.

Response: Yes, but doing crypto on the client is the only way to get end-to-end encryption, which is really the only kind of encryption worth a damn. Without end-to-end encryption, the server definitely knows what you're saying, whereas with js crypto there's a possibility the server is hacking your communications, in a way that's at least somewhat detectable. Using js at least provides a way to get reasonable security, and is potentially a way of bootstrapping secure client-side encryption.

Is my thinking wrong?
I pay for everything I can with my credit card. It means I have a digital trail of all my spending, which makes budgeting much simpler.
This only works if your site has something to do with development.

Or are you suggesting posting development related topics to a non development related site purely to get those juicy backlinks (and thus good pagerank)?
How to Recover Deleted files on Your MAC OSX
How to make your django app slow
And that's why you need a separate terminal to enter your PIN (at least here in the UK, although I'm fairly sure that also applied in Europe), and the PIN number is never transmitted to the actual POS application, just a token indicating success or failure.
The disappearing virtual library - Opinion - Al Jazeera English
I love that it's open source

Technically not open source. It's released under a Creative Commons CC-NC-SA which is not an open source licence, and is not approved by OSI nor FSF

However, the source is available, and it's CC, which isn't exactly a propriatry programme.
Although the immediate parent is being downvoted, it's actually interesting to understand why Apple have allowed this without collecting a % of the transaction fees that Square receives.

Or perhaps they are collecting a (lower?) percentage.
Friendly games 2011 wii accessories
friendly games 2011 wii accessories
Do you have search below playing WII game If yes later an individual would like in direction of undergo.
Ok, look, I actually think it is a vulnerability to most approximations which isn't what comes across in what I wrote.

That said, I don't think what raganwald was saying was sophistry at all. Sophistry implies an attempt to deceive. He was just being pedantic and a little narrow with his definition of vulnerability.

So when you say his argument sophistry, and then follow up with "... and I'm not interested in playing the "try to be right on the Internet" game with you." you're just lashing out. So that's probably why people (not me) where downvoting without replying.
WATCH Arsenal vs AC Milan live streaming online
Arsenal vs AC Milan
Match schedule:
Uefa Champions League
Round of 16
Date: Tuesday, March 6, 2012
TIME : 19:45 GMT
LOCATION: Emirates Stadium
Watch Arsenal vs AC Milan live streaming and also watch Uefa Champions
League full season live streaming online. You can enjoy this game on
your PC, So why you miss this exciting race? Get the best online
sports coverage on the net directly on your PC.
Hi Salvatore. I'll run it on my alpha board this evening and let you know how it currently performs.
They were not malicious but, imho, they crossed the line. It's not be too difficult to justify something simple like opening a closed issue but once he did things that interfered with other peoples accounts that's the point at which I feel no sympathy for for him being suspended.
The most useful thing we can learn from indeed.com is that they are all baseline noise compared to Java. So you're wiser to let your own priorities dictate your choice and forget popularity at this early stage.
Oh wow, that nickmartini story is really something. Trolling through github ? Just sad.

And github forgetting the block user functionality makes me think they don't want to listen to user needs. Sure, it may not be a very popular request, but I bet for a minority it's the most important.
Setting Up ProFTPd + TLS On Ubuntu 11.10 (Oneiric Ocelot)
The problem is, the fact that you don't use mass assignment is by far the exception rather than the rule. Every notable Rails tutorial uses mass assignment. Every person using InheritedResources is using mass assignment. GitHub is using mass assignment. Passing in params more or less raw from the controller, and leaving cleansing and validation up to the model is as strong an idiom as there is in Rails.

Regarding your ActiveRecord example, I would totally agree that there was a hole if the standard approach to running SQL was to use find_by_sql with string interpolation. Fortunately, that's appropriately viewed as an option of last resort, with appropriate amounts of "here be dragons" around the dangers of calling that method. Meanwhile, tutorials gleefully do mass-assignment, with perhaps a footnote about attr_accessible, which was of course not included for the sake of brevity.

It might be worth saying that Rails strictly as a framework does not have a security problem with mass assignment, only a very dangerous tool, but there is certainly a problem with the culture regarding it.
Teaching standardized languages helps to reduce discrimination. Discrimination against African Americans (in general) is rare now, but discrimination against people who speak Ebonics is high. So is discrimination against people who sound Hispanic, and to a lessor extent many regional accents.

If SWE is taught well, it helps people from poor neighborhoods get taken more seriously. If it wasn't taught, only people from richer neighborhoods would know it, and would be used by rich people to exclude upstarts.

That said, using SWE to discriminate is a bad thing. It's just a little less unfair than discriminating based on the fluency of a dialect that poor kids never had a chance to learn.
No, with laws you can appeal them. You can argue with words (not fists). Decisions are made by neutral third parties. There are rules about what evidence is allowed to be used against you, both that the evidence has to be true and has to be obtained in a proper manner.
I used to see this argument a lot from PHP people. You know, it's not PHP that's insecure, it's all those novices writing insecure PHP code.

Except that PHP makes it so easy to write insecure code that novices are pretty much guaranteed to produce vulnerabilities and even experts have to be vigilant to avoid accidentally stepping on one of the many landmines in the language.

If the designers of the language (or framework) put a landmine in it, and a developer steps on it, the designers of the language absolutely bear some responsibility for the fact that the landmine was there to be stepped on.
If you're paying then money, I doubt they would be able to enforce that against you.

If in doubt, ask your lawyers to have a look at it and get a legal opinion.
OK, as requested: You've missed something.

I've just run a few naive tests and all three versions on the linked page give the same result on every test, and yours gives different results on some of the tests. In short, your code doesn't work.

So you've missed something.
What other providers out there are using this so far? Is there a list of issuers anywhere?
Hands-on with iPad 3 Front Glass, Rear Shell, and Cases (video)
You can do opens source without being OSI compliant. They don't own the concept. As long as the source is readable, it is open, even if you can't redistribute it, or distribute a binary built out of it.

In this case:

http://creativecommons.org/licenses/by-nc-sa/2.0/ says that

You are free:
* to Share — to copy, distribute and transmit the work
* to Remix — to adapt the work

Provided that you (paraphrased):
* (BY) — give proper credit to the original the author,
* (NC) — don't use it commercially,
* (SA) — publish your modifications with the same license.

Beside the non-commercial clause, when applied to source code, it is roughly equivalent to a BSD/MIT license.
That's awesome asb, thanks!
On top of that, Rails sometimes seems like it goes out of it's way to make attr_accessible a pain to use. I know more than once on my team someone has spent more than a few minutes trying to figure out why a model wasn't updating before they remembered to add a property to attr_accessible. In one case, we had a (rarely-used) field uneditable for a few weeks due to it not being included on the list.

I really liked wycats proposal of moving this sort of thing to the controller - it's a much more logical place to look, and I do think there's a thing as a too-skinny controller - mapping inputs to model attributes is a perfectly sane thing for the controller to do IMO.
What the guy did was not only morally irresponsible but also criminal.

The security community has long has an accepted standard of responsible disclosure, which involves informing the vulnerable party beforehand and allowing them time to fix the problem before publicly disclosing it.

Publishing a vulnerability before giving those vulnerable a chance to fix it is irresponsible, using it to compromise a system is criminal. He was getting off light from getting his account suspended, GitHub could push for a criminal prosecution resulting in deportation and serious jail-time for his actions.

It doesn't matter what he did after the compromise (whether it was benevolent or not), the compromise of an account not held by him puts him clearly into the "black-hat" category.
Ethics? He's made his point.
Outdoor Training, Outdoor Trainer, Fitness Trainer
Personal training at Alivept.com.au studios is a great way to tone up and get into great shape. We offer fitness programs and weight loss programs catered to your needs. Book now for your free personal or group fitness session.
How to stay healthy on the road
Asynchronous HTTP Requests in Perl Using AnyEvent
No, not only. You can host software packages and tutorials on your product website.

For example, patio11 of HN fame has an article about Rails SEO Tips on his product website http://www.bingocardcreator.com/articles/rails-seo-tips.htm

Even though I'd say that he could have done a better job at integrating it on his website (it looks too much like an isolated page in my opinion - there should be a "Tips for developers" section), it does the job at attracting links and boosting SEO for his main site (also with A/Bingo, a software package he developed: http://www.bingocardcreator.com/abingo).

Actually he developed a blueprint of what could be done for startups regarding SEO: http://www.kalzumeus.com/2010/01/24/startup-seo/

And here you go, he got three more links for free :-)

-
Perhaps, but now he might be able to get 10 times that
> Github did have a bug and noone knowledgeable about Rails appears to have made even a cursory inspection of the security of their controllers
> Github had a pretty terrible bug
> but the certainly don't deserve this sort of mon hatred

For all the free fun you can have on github, they are in the business of selling private repositories. What could possibly have been worse than someone finding a bunch of bugs in a matter of days just to prove a point about Rails?
While I agree most things could be split into chunks with a timeout, there's definitely a place for web workers, for example in canvas image processing.
Two Sources of Stress that (probably) apply to you
Downvoted for pointing out what the OP conveniently ignores? Or downvoted for daring to even appear to go against the hivemind?

Edit: I guess that answers that question. As pointed out in other threads the response to this has shown that HN is no different to other sites and not in a good way. I wasn't even being critical in my original comment but the very suggestion of dissent against the mainstream response is deemed non-conforming enough to warrant anonymous downvoting. That 'hivemind' mentality is the reason I left Reddit. At least others have pointed out this more eloquently than I in relation to this incident.
Bidify Bidify
This Website is for Making money Online ... It is The best Home based Business for Earn Money ..
The idea is only to motivate
Myhrvold is basically an arms dealer, more than happy to kill both sides. The guy couldn't create anything useful by himself, so he put his intellect to use as a merchant of destruction.
Audio Cambridge School Dictionary v3.2.94 Apk App | apps mobile
Key Ingredient To Massive Hits Like Pinterest And Facebook You Should Copy
What was the strategy behind the Nokia 808 Pureview’s announcement?