skysight-inc/HackerNews huggingface dataset:
Exactly. There are some well-paying niches where a "polyglot programmer" will be required, e.g. C++/Python, Ruby/Javascript... knowing only part of the required combo will likely not get you the job or curtail your remuneration.

A career-minded person could just expand his core competencies in order to nail those niches. Not everyone enjoys hacking LISP in their spare time, but expanding your horizons is the right thing to do if you care about your job prospects. If you write for the embedded market at a low level, pick up something higher in the stack; if you only dabble in high-level languages, try looking under the hood; if you specialize in particular technologies (e.g. C#/.net), look at their complementary stuff (e.g. javascript, powershell, or even Java interop and VC++).

Also, "learning a language" could just be "learn a big framework / toolset". For example, if you know Python, you might want to pick up Django, or a GUI framework like Qt, even if they are outside the boundaries of what you need at work: they tend to have their own programming style and quirks, so they can be key technologies to bring you new opportunities. Java has boatloads of big frameworks, chances are that you don't know all of them. Ruby people tend to live all the time in their Rails ghetto, but there's a world of libraries outside that. And so on and so on.
As the author of the post points out, hundreds of thousands of apps rely on Github, so to an extent it is their responsibility to block people who may jeopardize their users.

But they haven't blocked him. They blocked his account, so all he has to do is create another.

Github has put their users in far more danger by being dicks to a guy to gain nothing.
Can somebody explain why this is a Rails bug?

Meaning using mass assignment is very similar to SQL injection: you pass variables from user input directly to model without even verifying them. Duh?

Now regarding GitHub: yes there is a security hole and they fixed it.

However, hacking a site after finding its vulnerability is definitely illegal and hope there will be consequences. And he did not even report a problem to GitHub.
Reporting it to github wouldn't have demonstrated the problem he was trying to flag. His problem wasn't "gitub is insecure" but instead "rails by default is insecure." When told by the rails team that fixing this problem was the responsibility of rails users, he demonstrated that even the most sophisticated users (presumably, github devs) were exposed.

If he had submitted a bug report to github, they would have probably just fixed it. And the problem he was flagging in rails wouldn't have been any closer to fixed.
I used to use them years ago and it certainly wasn't issue free. When they took away their free private accounts it was a pretty big pain only to have them re-implement them less than a year later.
I personally know some people that work for Atlassian and they are awesome. Moreover, they really do care for their customers. I have no experience using Bitbucket, but given the people I know I would definitely trust them.
The account was suspended, not deleted. That was made clear to everyone. Suspended does not mean banned, it does not mean canceled, it is impermanent by definition.
Cut 'em a break. I sympathize with your statement, but I give Github a lot of credit for correcting their error and reinstating his account.

As a general rule, it's extremely hard for organizations to admit their own mistakes.
It's obviously not "breaking". In fact "breaking" is the difference between burglary and theft, and theft insurance is way more expensive than burglary insurance (which I experienced today reading an insurance offer) , because theft is nearly impossible to prove and usually due to the victim's negligence.
How so? Each git user has a local copy of the whole repository.
I'm inclined to agree with you, but, to play the devil's advocate, "we're temporarily suspending you...oops, no, it's permanent after all" is not a position they want to find themselves in.
Sorry - updated. I was focusing more on the notion of GitHub suspending his account with the intention to re-instate it after clearing uncertainty. Their lack of communication with him is inconsistent with a rational reaction to that assumption.
Map in C
Why I really love SCRUM
Maybe the right proposal is just to disable mass assignment by default? Meaning there is already white listing functionality - always specify attributes you want to save.
> Verbal, physical, written or other abuse (including threats of abuse or retribution) of any GitHub customer, employee, member, or officer will result in immediate account termination.

Guess they should terminate this one, then:

https://github.com/rails/rails/commit/b83965785db1eec019edf1...
Brogramming has always been a joke at FB.
Our tortie of 14 years passed away last year. They can be really unique cats. She really only bonded with my wife and me. To everyone else, she was a sassy ball of attitude; but alone, she was the sweetest cat. No one believed us when we told them how affectionate she was.
That cat helped keep me sane through some crappy times. I miss that cat.
The "whole point of the article" was that the reaction from GitHub should have been different. It should not have been. They knew the cause of the issue immediately. They resolved it immediately. There was no reason to involve him. He broke into their house and publicly announced how to cut your own key, so they changed the locks and got a temporary restraining order.

Nothing to see here, move along.
The author says Github ignored the issue when it was reported to them, but cites an issue opened on the Rails issue tracker. Unless I missed Github's acquisition of Rails, I don't see how that counts as reporting the issue to Github.
There are certainly lessons to be taken away, but this whole thing has devolved into a witch hunt.

Take away the good, move on from the bad, and get back to making software better instead of treating the OSS community like a soap opera.
Be an adult and don't hack Github
I agree with you, but even if this was a reaction to public outcry the real reason to be disturbed is that top-notch Ruby devs like the GitHub guys didn't use attr_accessible. I can't wrap my mind around that.

That you have to use attr_accessible is known throughout the Rails community since "ever". Only toy apps don't use it.

It's like saving passwords in plaintext, only arguably even worse.
I actually defend Github on that front too. Let's take the long view here - Github has a growing code base and this won't be the last 0-day exploit they face. Do they really want to signal any future person that they're ok with being broken into as long as it is 'benign'? If I were Github, I would want to be telling people "Hey, work with us and you'll get your cred as a security researcher. "

I reject the dichotomy that this pushes people to sell their exploits on some illegal market. I think if people wanted to do that, they would irrespective of what Github did.

It took many years for the security industry to arrive at responsible disclosure guidelines; there is a reason they exist.
Can somebody explain why this is a Rails bug?

Insecure by default. Microsoft used to be the laughing stock because the default install was vulnerable to exploits. While one might argue that Github devs should have known better, the counterargument is that if Github devs couldn't get it right, think about the thousands of people trying out rails for the first time, building their little web app.
'It's called being a cynical asshole and there's no known cure'
If the project was deleted from Github, you'd just have to create a new one push a local clone to it. That's hardly what that point is saying.
Would those of you who object to this tactic also object to collecting website analytics (which in my experience many normal users, including members of my own family, do not understand either.) If not, why not?

This isn't a rhetorical question; I'm sincerely curious. Thanks.
You can't chop off half of someone's sentence and then debate the leftover part. Not at an "and", at least.
Twitter suspended homokov's account
"and we worked with him to fix it in a timely fashion"

Did this take place in private? I can't see any evidence of this from his issue on the rails repo.
The usual phrase would be along the lines of "pending a full investigation", which is what they should have said, but people often fail to. PR is hard enough when you're calm and collected, in the middle of a shitstorm it's a miracle if you can fully articulate what is and will be happening.
> I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, ...

The latter violates the Computer Fraud and Abuse Act, creating huge imprisonment and employability risks.
Seriously. This is easier than SQL Injection! Props to Egor for finding it and showing how stupid it is. I cracked up at his "is it really interesting?" line. It makes me wonder if this was a well-known vuln to less-than-classy folk who have already done some damage elsewhere on GitHub.
I'm not a fan of some of the comments about the man posting, you'd think the developer community would be above "you look like frankenstein" and "your english sucks."
Well, I don't think you gave this a fair read.
I've had asthma my whole life. Just a few years ago I realized that my nighttime asthma problems were caused by acid reflex and I stopped taking my asthma medicine and replaced it with acid reducers. My asthma medicine wasn't helping. The most important thing now is that I sleep on my left side.

This is something I figured out myself based on Googling. None of my doctors ever suggested it.

I am not sure if this was my entire problem my whole life or if its just gotten worse recently and that's why I notice it more.
It's still true to this day. Real scene is still done with FXP and then leeched down the food chain to BT/NGz/p2p/etc...

Releases are out for hours before they even make it to open user levels.

Get it where it's hot, yo.
If github users quit because a hacker deletes their stuff, maybe that's harm the hacker did to github.

But if github users quit because a hacker shows them github is insecure, that's harm github did to itself. Don't blame the messenger.
That's one thing I never understood about Google: just how does it decide that something I clicked on was really what I was looking for?

For every person who was looking for photos of the explosion, there are most likely many more who were looking for general information about "Camping Alfaques" but clicked on the thumbnails out of arguably morbid interest. I know I wouldn't resist clicking on that stuff to see what it's about, it seems to be human nature.

So, in the end, how does Google distinguish people's objectives from their curiosity?
Could you elaborate on:

"Otherwise you're limiting yourselves to businesses that both have the vision to see the potential AND have the available resources to implement it into their workflow."

I don't quite follow what you mean.
I don't think I am missing the point.

Medical R&D in the US amounts to about $100 billion/year. (I misremembered a slightly higher number previously, but the ballpark is the same.) Meanwhile, the US is spending in the neighborhood of $1 trillion/year more on health care than if spending were on the same level as a typical European country. Yes, I understand that those R&D costs get baked into medical costs, but they simply don't account for the vast majority of the discrepancy.

If the US system cost the same as a typical European system with the exception of US R&D spending on top, the discrepancy would only be around 10% of what it actually is.
Project 101010 - Pill or Perception
We are infinitely more powerful than we give ourselves credit for. The most amazing computer we'll ever have is our own brain, learn how it works, and what it has the potential to do for your body if not maintained correctly.
Maybe not? https://github.com/rails/rails/commit/b83965785db1eec019edf1...
I agree, and quote: "Please stop writing provocative statements and behaving as if the sky is falling on top of your head and the very fiber of our being is at stake. An open source language and a website written in that language were shown to have a flaw. Which has since been fixed. I hate developers who like to sound smart at the expense of somebody else. Get over yourself."
Until proven otherwise, all code hosted on GitHub must be assumed tainted, where potential 0-day has been inserted.

You should consider revealing a history of all public key changes for each project (assuming you still retained apache logs) so that people can decide for themselves how much work they have ahead of them to re-audit their past commits.
Aha. Thanks for the extra info.
Read https://github.com/rails/rails/issues/5228

The vulnerability discoverer tried to explain the dangerousness of the bug multiple times... but he was ignored despite attempts to show benign ways to exploit it.

So he did the right thing by exploiting the vulnerability to perform a rogue commit to the master Github repo. No one was taking him seriously.

Now Github finally fixed it!
Well, there's the echo chamber effect. You search for something previously unknown to you, you click on something that catches your eye, thereby suggesting it for the next person.

Rinse, repeat.
Props. Nice results, and beautifully presented.
A Case For Conscious Consumption
The problem was that I was doing it as follows:

insert/insert/update. Wash rinse repeat.

The better way to do it (which solved the problem was:

Insert a bunch of rows, insert a bunch of rows, update a bunch of rows, no repeating.
We suspended it after fixing the bug to make sure he didn't retain access to something he shouldn't. We rarely do this, but he wasn't upfront with everything he was doing on the site like people that disclose vulnerabilities responsibly.
If you see someone on the train reading Twilight, how do you distinguish between someone who likes Twilight and someone who is taking seriously the idea "don't judge a book by it's cover" and giving it a fair reading before deciding?
This has nothing to do with NNTP, BT, P2P. All FXP to distributed FTP servers. The RARs are split so that if one server in the farm goes down, the whole release isn't corrupted. Same for transferring the data.

"Racers" move the els to multiple servers. Split RARs allow for multiple people to be moving parts of the same els at the same time.
That's pretty cool. How does it achieve that? I'm assuming it assigns a higher priority to the chunks closer to the playback cursor.
They did that in this case, because it apparently wasn't clear enough. Their real response was to create this: http://help.github.com/responsible-disclosure/

Which more explicitly forbids this.
And for the record, this was found in staging phase. In other words, we run it through sanity tests in a development environment, it gets rolled out to staging, tested there, and then production. Staging is usually a copy of production a few weeks old at most.
I find the multi-step unsubscribe frustrating too. But how do you address the issue of email forwards, where recipients who don't delete the footer (ie, everyone) are unwittingly forwarding everyone the ability to unsubscribe them from the list?
I'd rather see a system that replaces man entirely. Maybe with a modern markup language like XML, Markdown, or HTML.

A system that makes documentation less painful by letting me connect to a server to downnload man pages potentially written by people other than the project maintainers. I'm not sure how you would match man pages to programs, but it would be preferable to the current situation where unless the project maintainers don't see docs as an afterthought, the on-line doc system gives you sub-par information.

You could also add radical concepts like hyperlinks. And you could fix the broken linear paging metaphor. Which doesn't work for documentation more than about a page or two long.

As for backwards compatibility. Symlink man to the new system. Done.
Obviously it could go either way, but I feel like Foursquare is just starting to hit their prime as they shift away from solely a check-in app to leveraging their existing check-in data (1.5 Billion check-ins) to provide better recommendations for users.
I would imagine the reason kids are likely to prefer graphics is because the games they play involve a lot of graphics so that's what they expect.

I remember in the early 90s plugging away writing various text games in QBASIC then excitedly showing them to school friends who's reaction was mostly "too much reading, not enough guns. Let's play Doom instead".

Of course this was somewhat disheartening and put me off programming for a few years.

The closest thing that I've seen to a comprehensive game creation "kit" is Unity3d but that has a pretty steep learning curve.

One sort of introduction that could potentially work well for teenagers would be to create a mod for an existing game that they already enjoy.
I'm inclined to believe GitHub did exactly what they thought was best. That is to say anyone's knee jerk reaction would be to suspend the account as quickly as possible, for whatever good it might do... I can't fault them for what they did. When someone hacks you, you need to act very quickly because your customers are more important than your ego. I do believe they should provide incentive for responsible disclosure though.

Edit: spelling
Link to the patch?
I am not familiar with Rails, so I am a bit confused about what caused this. What does it have to do with mass-assignment?
Air Jordan 4 IV Retro Cement White Cheap for Sale
A programming language can partially influence the way you think (a form of Whorfianism http://en.wikipedia.org/wiki/Linguistic_relativity), but a PL is a poor substitute for actual thought.

Thinking in terms of any programming language limits the ways you can model problems and solutions. Of course, learning ways of modeling expands your repertoire. I would hesitate to say that "programming languages" are the richest source of such models. Even within them, features like dynamic typing and closures are less significant than logic/constraint programming - or GPGPU languages.

On a separate issue, we can also see programming languages as an instance of exponentially improving technology (Kurzweil). I haven't seen a chart of the productivity improvements of "programming languages" over time, but certainly there's no contention over the dramatic improvements from raw machine code, to assemblers, to compilers etc.

The mechanism is the same as for increasing returns for technologies: standing on the shoulders of giants, and seeing further, especially ways of doing things (the meaning of "technology"). That is, we create the next generation of programming languages using the previous generation (and benefiting from their productivity). e.g. we wrote compilers with assemblers, then with compilers, and then with specialized tools (yacc, lex etc).

At the forefront of technology, it's not always obvious which ways will turn out to be best til afterwards - it's an exploration of the news, which is unknown by definition. Anyone who thinks they know the answers before they start exploring misunderstands the nature of exploration. Before we have definite facts, we have opinions and contention - which is all for the good, if it causes people to look harder rather than argue blindly.
Pretty HTML Canvas thing from a 30 year old magazine
I completely sympathize -- this is the first time I've heard of a truly good rationale for search-result modification.

BUT a slippery slope is a slippery slope, and Google would be opening itself up to hundreds of thousands of suits if this one succeeded.

HOWEVER, there are still two options open to him:

1) Embark on an aggressive SEO campaign to link his guesthouse/campsite's name to nice images (though this may be exceedingly difficult)

2) Change the name of his guesthouse/campsite (very annoying, but certainly feasable)

If I were him, I'd change the name.
For most of the non-technical sites I have manged the number has been between .5 and 3%, I would assume the number is higher for sites that are frequented by more technical users. This article http://developer.yahoo.com/blogs/ydn/posts/2010/10/how-many-... says it is around 1%. Keep in mind that it was compiled in 2010.
SG's "open tracking" is a great feature!
read http://blog.mhartl.com/2008/09/21/mass-assignment-in-rails-a...
#attributes=, #update_attributes, #assign_attributes=
EFF has a network of people they can put people in touch with, even if for a variety of reasons they can't offer legal help in a particular instance.

But that's not the point. While we can be grateful for the CCC and the EFF for existing and doing the community a great service, we can also believe that their extraordinary contributions should be unnecessary.
I know next to nothing about publishing, so do take my opinions with a rather sizable grain of salt.

With the growing prevalence of ebooks, the "waste of paper" seems a bit weak. And the ridiculously rapid pace of tech advancement strikes me as more of a boon than a problem - for most topic-centric books, you only get to sell it once to an enthusiast. With tech books, you get the opportunity many times over.

"rather than buying tech books i just read blogs, quora, stack overflow, and i think a lot of people do the same. it's faster, cheaper, etc. for example, as i am learning iOS programming, the docs on apple.com are great, as are some third party tutorials."

And if the content of the book doesn't outpace those sources - I wholeheartedly agree, the book shouldn't exist. But I buy books with the expectation that they do provide me with a better and faster experience than I would have gotten by just googling on my own.

All that said, I sure as heck haven't written a book. So obviously the author is better versed on this topic than I am. So, giving them the benefit of the doubt - perhaps there's some sort of opportunity here. Like (pulling at the lowest-hanging fruit), rather than creating "just" a book, creating a subscription-based community around a topic?
Mark Cuban Closes Out MIT Conference with Candor
I wonder if his poor English (though not as poor as my Russian) contributed to him not being taken seriously? Glad to see he was reinstated...the guy seems almost fanatical in his devotion to GH.

It is almost reassuring that the. If was so easy to exploit, because it means that a nonchalant hacker could bring it to mass attention...I'd hate to think of what havoc a dedicated miscreant could've sown in a week. I recently taught a group of neophytes how to use the web inspector, and used the example of altering a form merely to demonstrate the malleability of a webpage. I told them "this is just a parlor trick, don't think that it'll actually work..."
GA "can" track non-JS users, but it requires a server-side implementation:

http://code.google.com/intl/en/apis/analytics/docs/mobile/mo...
Copyright violation isn't restricted to verbatim reproductions. I sympathize with eps. There are also a good number of people, believe it or not, who think that GPLv3 is too vague with its "distribution" criteria that a court could determine that it's effectively the same as AGPLv3. So if there's a policy not to use AGPL, which is fairly common because SaaS is an easy way to create the "secret money making sauce" of a business otherwise built on open source, GPLv3 will also suffer adoption.

eps' general concern is that this is entirely a court matter; the spirit of the GPL and sharing is meaningless to the law because at the end of the day there are only so many ways you can type "LIST_INIT(&new_sched->new);" and if a shitty programmer/programmer's company is suing you and has evidence you looked at that line of code that may be enough for a shitty judge to side with them. For similar reasons I don't have a habit of looking at patents (though that's usually because patents, even non-software-patents, are shit and obvious to the layman let alone someone in the field), but I do read (and have contributed to) GPL code.