skysight-inc/HackerNews huggingface dataset:
The problem is people are still confusing two issues.

1 - The mass assignment rails issue was resolved as soon as could be after it was reported
2 - The public key form update vuln was NOT reported and used, NOT to attack github but to make some point to the Rails team.

The second issue was the one github had been talking about in the original blog post. They handled it as soon as it was discovered.

In so far as they responded as quickly as possible, yes they had it in hand.
On one hand you have `update_attributes` - IMO you should just never use this (seems raganwald agrees), but hey, it exists and it can be useful for simple stuff. So on the other hand is `attr_accessible` - You need to specify what is allowed to be mass-assigned if you want to use mass-assignment. This stuff is covered in the basic Rails Guides (http://guides.rubyonrails.org/security.html#mass-assignment).

Saying that `update_attributes` is a security vulnerability doesn't really make sense... it's like if I said cars can accelerate to very unsafe speeds by default and this is a huge safely risk, ignoring the fact that cars also come with brakes :)
Off topic, but I never thought I'd see someone on HN refer to the desktop tower as "the CPU". That's what Grandma does when she points to the LCD monitor and says "the computer".
Show HN: Relaunched landing page with Bootstrap
Right now I have 2489, and the special ability I got when I hit 500 or so was the ability not to care about Karma anymore.
This argument might hold up weight in some people's eyes when you're pirating commercially available music.

This wasn't in public circulation; I find it much harder to validate the view that this wasn't a theft.
The speed up options was really a stroke of genius. I caught myself reading ahead of the transcript and not paying attention to the video till I set it to 1.5x.

It was just a tiny learning hurdle when there are 3 different navigation bars (main at the top, secondary on the left, and tertiary under the main) for courseware section.
>> "Type the name of almost any successful consumer web company into your search bar and add the word 'addict' after it. "

^ I really think he means "successful gaming or social media consumer web company." "Dropbox addict" just sounds silly.
Ouch, I felt that. I need to whip out the textbook of the algorithm analysis course I dropped out of to make the hurt go away.
> It’s not like there’s a controller method called ‘update’ created if you don’t write one that uses mass assignment. You have to generate or write an update method, and if you do and you include a sql query, you have to get the sql fragments right.

Or install a plugin and inherit one:

https://github.com/josevalim/inherited_resources/blob/master...
That's not how git works. I have the entire repo locally. If I didn't, I wouldn't be able to commit anything. So if Github goes poof, I'd be pissed, but I wouldn't lose a single line of code. I would obviously lose things like issues/wiki. Actually, it would be pretty cool if Github turned issues/wiki into some sort of git repo of markdown files and allow me to pull them and commit to them. Something for them to think about =)
Ask HN: 60 days of employment before health insurance?
I was recently offered a software engineering job, but told I wouldn't be eligible for the company health plan for the first 60 days of employment.

This seems like a big red flag to me for how they view/treat employees, but maybe it's a standard practice of which I'm unaware. Do other companies do this? Would you work somewhere with this policy?
Well there's breadth of expertise. Part of CS is systems, which includes networking, operating systems, compilers, and so forth. If you're making any of those things or leaning heavily on them, you want to hire people who are grounded in those fields. Same goes for things like AI, machine learning, data mining, and so forth.

More generally, having seen more kinds of software kind of broadens one's way of approaching programming problems, so even if you don't directly use anything you see when you study operating systems or compilers or AI, you can grab vague approaches and ideas from those fields.

If you're interested in writing performant software, you'll care about big-O, algorithms, and data structures. Understanding algorithms and data structures enables you to intelligently choose and apply them even if you don't have to develop them from scratch.
I already told you: prestige. There is no profit motive, despite anything to the contrary you might have heard from the FBI or BSA. Occasionally people will enter the scene looking for ways to make money but this kind of motivation is seriously frowned upon and the individuals in question are often publically scorned. Simply: you don't earn any rep from being a conman or petty ripoff artist.

Here is a little more context:
Most release groups consist of individuals who break copy protection for fun. They compete amongst themselves to create clever hacks and one-up each other. It's a very tightly knit tribal culture: me and mine vs you and yours. Cracking releases or moving releases from one top site to another becomes an interesting game and so too are the metagames and scene politics that surround it. For example: a courier might strive to get friendly with site admins or group leaders who are privvy to upcoming "pres" (or pre-release) so they can get a leg-up on the competition. Be among the top 10 traders on a site for a few weeks and suddenly you have a reputation: you get invited to trade on more prestigious sites, join more prestigious groups and generally pal around with community elders. You develop very strong bonds over time and that's what keeps you in: the scene is where your friends are, it's where people know and respect you. Plus, the competition to be the best can be intoxicating.
Cricket Equipment
Cricket shop supplying cricket bats and equipment by Kookaburra, Gray Nicolls, Gunn & Moore , Slazenger, Puma and other top brands. They offer many items at reasonable prices and have trained staff to advice on their range of cricket equipment.
Well I didn't blame Github, did I?

I'm just pointing out the seriousness of the situation.

Punishing Egor Homakov in this case is a classic example of 'No good deed goes unpunished'. Had this vulnerability been found by somebody with evil on his mind. We would be having a very different debate now.

We all make mistakes. And I don't really blame Github for this. But we must at no cost downplay this incident.

And discussing about this will only do good.
* Shameless plug * We are working on app that aims to make collaboration with Git extremely simple. It's targeted towards people like your coworkers. Essentially, the idea is to forget about the complexities of version control and to just focus on your work. You can learn a bit more here: http://gitpilot.com
What Every Programmer Should Know About SEO
Is This the iPad 3? [video]
Good to know because I leaped before I looked, never had AP level physics and barely any calculus but 1/3 of the way through an electronics cert.
Because it's trivial for him to set up another account and break the service from there. His ability to do this exploit wasn't tied to his specific account. His point was that anyone could be doing this.

=edit= Sorry, I am apparently agreeing with the comment I replied to.
* What happens with the transition to cgroups, checkpoint restart?
* How is openvz going to handle btrfs?

For those reasons I'm going to stick with mainline and wait as all the bits are almost implemented and the wait be within a year.
I've had to wait at at least 1 job I had, although it was years ago during the dot-com boom, & I don't recall how long I had to wait. It didn't matter to me at the time, and I didn't think anything of it.

I recently read a book on hiring, and it said it's a common practice.
I'd venture to guess similar to the cost of running one here. ;)

(Disclosure: I have no association with either Wired or Pwnie Express.)
Your Opinions Are Bullsh*t
What gradstudent said. For the prestige and respect. It's a rush, addicting and exhilarating.
I'm not sure I'm 100% articulate here, but feel that it's imprecise to call what Google to doing to produce search results an "algorithm".

quicksort is an algorithm: the input and output are well-specified, and the algorithm is provably correct.

Google's search engine uses 100's to 1000's of heuristics created by humans to generate the results. Is it really an algorithm? Yes, pagerank is an algorithm like quicksort.

But the Google search engine uses pagerank as one among the 1000's of "signals" during result generation. Maybe people think Google uses only pagerank and that's why they keep saying that Google uses an algorithm.
Why Every Analyst Should Learn To Code
You confusing mechanism and policy. Sure, Rails includes a mechanism that closes this security hole. But it requires additional effort to apply a more secure policy. The security baseline is not elevated by the mechanism.

Historical experience has shown that no matter how excellent the mechanism, the practical security baseline is determined by the default policy.

Windows NT has had, since inception, a far more sophisticated security mechanism than the default unix model. But that doesn't matter in the real world, because to retain backwards compatibility with Windows 95 (and through to DOS), almost no security policy was shipped by default until Vista.

Was Windows insecure? According to your criteria, no. According to the actual real-world consequences, yes.

The bottom line is that policy matters and that in this case, the rails crew have chosen a demonstrably bad policy.
so maybe some novice developers write an app using the generators and scaffolding baked into Rails, and as a result they get a security vulnerability that a more experienced developer might have avoided by doing extra work, and you say that's not a security problem in Rails?

Young man, do not take that flippant tone with me (raps ruler on desk). Those novice developers failed to RTFM. If you want a framework that produces secure applications for inexperienced developers who do not read the fine manual, you are setting a laudable goal for Rails, but I hardly think that “Secure even for people who are 1. novices and 2. compound their ignorance by refusing to RTFM” is synonymous with “security problem.”

If you open your history book to when Rails was first becoming popular, there were many people grumbling that because it was built on top of a dynamic language that it was vulnerable to all sorts of bugs caused by novice developers getting their types wrong. The argument at the time was that Rails provided a certain type of freedom and power at the expense of certain safeguards. The same argument was played out when people started noticing that monkey-patching run amuck caused certain problems.

I agree with you that this is a design choice. If you want to say that you disagree with the choice as it was originally made, I agree with that too. I won’t say that I would have made a different choice back when that feature was first baked in, I did not write the framework. But here we are today, and it seems like a very good time to make a different choice.
I've never worked for a company that did that, but I've heard of some that do. Ask for an exemption to that rule, or failing that, try to negotiate a signing bonus that would cover COBRA or an individual plan.
Get a Guaranteed Approved Auto Loan for No Credit History | ArticleCube.com
I disagree; over the last three months up here in suburban Minnesota, I've finally started to see multiple people already checked in when I open the Foursquare app to check in at mundane locations like grocery stores, clinics, and libraries. To me, that indicates that it's finally gaining widespread acceptance and usage, akin to Facebook.
You didn't read the article:

> Tapping on links will launch Mobile Safari, which jumps
> out of your standalone app. There's a way to prevent that
> and make it load inside the standalone app, but since the
> toolbar is gone, there's no Back button and you can't go back.

Unrelated note: what's best practice for quoting on HN?
Nobody goes to that club anymore… it's too crowded.
"Your resume is great, anyone would be lucky to have you, but we don't know how we'd use you here." That makes sense, her primary experience for the past several years has been in a hybrid consulting/strategy/sales/marketing role..."

It sounds like you need to really define the position she is gunning for.
I respect your work Ken but I disagree with you on this.

Rails is just a web framework and does provide developers who use it with the ability to use it securely or insecurely. In this case, the shipped default leaned more toward convenience than security. There are tradeoffs involved.

GitHub provides codebase hosting to thousands of projects, some of which are private. They have a large public attack surface. And they're business which takes money. And they're probably making millions. This should imply certain things to it's management team. It's reasonable to assume they'd take security very very seriously. Perhaps not need bank-like level security, but still, pretty well up there.

Any Rails app developer has had the ability to unilaterally go into their own codebase and fix/close any security vulnerabilities. This same ability does not exist for users of the GitHub webapp. (Of course, we could choose not to use GitHub, but that would be good neither for GitHub or the user.)

That said, security is hard and getting it 100% right 100% of the time is probably impossible. And I love GitHub, and think they get more things right than wrong, enough of the time, that I'll give them the benefit of the doubt.
The highly-upvoted mail-bug testing site in comments says gmail isn't vulnerable to bgsound - https://grepular.com/email_privacy_tester/
Van rental, rental van, 15 passenger, Dodge Sprinte,
15 Passenger and Sprinter van rentals with locations nationwide. Unique vans offering video screens, WI-FI, iPod support, power outlets and more.
The way you describe it, it sounds like there is a hole in every app and developers must close the hole to be secure. My claim is that Rails provides a completely optional tool, mass assignment, that opens a hole, and another completely optional tool that closes the same hole. And they document this well.

The one tool can be said to have a poor policy, I agree with that. But Rails does not have a hole in it. I did not have to rush to “close” holes in the projects I’m responsible for when I read these posts because I hadn’t used the tool in the first place.

What Rails has is a poorly designed tool. But if you’re going to say that if a developer can misuse the tool then Rails has a security problem, then I’m going to say that the exact same thing is true of ActiveRecord.
yay, Gmail via Safari doesn't trigger any of the tests.
The owner of the camp needs to take all his energy away from these lawsuits and focus religiously on SEO and do so on a daily basis!

He needs to create quality sites with tons of images about the camp itself, the area surrounding and others positive things related to the camp to purge/eliminate the problem. After he's created these quality sites he needs to go and do SEO tirelessly everyday until the problem is gone.

It's obvious per Google's in-action re: changing search result for the word, "jew," that he doesn't need a lawyer but a professional SEO(er).

Now if others in present day (like this Ars article) keep writing and blogging about the incident then SEO(ing) to the hilt might be a losing battle.
Where to run iOS, the "tablet" part would require a small processor, but the main CPU and circuitry could live with the keyboard. Someone was working on something like this with a stripped down Linux (or Android?) for the tablet, but I can't remember who (Lenovo?).
Troff is domain specific and even worse than info, man has one good thing going for it - it's a simple text stream.
I may have missed it - but it seems like the transcription for the videos is synced to the video so that you cant scroll and read it faster than the video plays. I'd love if it was scrollable somehow; for example, I could quickly read a section that was less than interesting, then click to rejoin the part where I want to actually listen/watch the video.
In Argentina you could buy a house near the capital for about half of that, and the rest would pay frugal-ish expenses for several years. Not enough to retire on, but plenty of runway for the next project.
> they will tell other people to do what we wanted

No, actually I meant us, but more as a whole. We all vote for laws that are mostly applicable to ourselves (except foreign policy). This is, of course, in theory.

I agree, though, that it's harder to enforce change if you don't have any perceivable stick. People in power can control elections, after all, and there's not enough transparency about what happens ‘at the top’.
Agreed. We've been talking about this. She's had to shape her resume a few different ways based on the type of job she's applying for to highlight specific experience relevant to the particular position but it still hasn't yielded much. I dont' know if it's the resume so much as not knowing the right people/perosn in an org to vouch for her even if she applies for something 'out of band' so to speak.
Er.. that's because there's nothing malicious an attacker can do with the mass-assignment vulnerability in the "Hello Rails" app?

Being able to change the :id or timestamps of the post isn't anywhere near the SQL injection vulnerabilities I've seen in many tutorials in other languages/frameworks.

I agree, though, I wouldn't recommend Rails to people who can't bother to read documentation.
Legalizing Pot Makes Roads Safer
Oh man, I couldn't disagree more. Not only is Foursquare still relevant and presumably growing, but there are a whole bunch of cool services building on Foursquare location data in interesting ways (Instagram, Path, Sonar, Banjo, etc.).
> My claim is that Rails provides a completely optional tool, mass assignment, that opens a hole, and another completely optional tool that closes the same hole. And they document this well.

The policy of the optional tool is broken. That's a bad thing. The entire point of a security baseline is to provide an attractor towards which design and code approach without resistance. If you want insecure, fine, but you'll have to go out of your way to get it.

Rails is not doing that.

> But if you’re going to say that if a developer can misuse the tool then Rails has a security problem, then I’m going to say that the exact same thing is true of ActiveRecord.

And I would agree. The allure of Rails is how easy it is to get something going. The problem with Rails is how easy it is to get any old thing going.

See also: every major PHP application ever written.
Whither programming language research?
1 + 2 + 4 + 8 + ... = -1
I have 12,300. Right around 10,000 I had this strong irrational urge to get onto the HN leaderboard http://news.ycombinator.com/leaders After I broke #90, I went back to not caring.
Maybe you do need to sometimes pull down someone else's pants to expose a problem. I think that's a moot point because nobody should really be able to disagree with that on pure logic. I think the important question is when someone feels they have no other choice, so they pull down the person's pants, should this be considered an immoral or criminal act? The guy can always say, "Look, I never intended to do any harm, I just wanted to get people's attention to fix this before someone who was intending to do harm came along." The problem is then how do you prove that they really were so benign? I think it'd be easy for a lot of blackhats to hide behind that if they ever got caught, or no? Even if there was complete immunity for people who immediately came out in the open and claimed responsibility for the sake of clearing the air, it'd still be easy for blackhats to hide their rationales in there, while they did something else more malicious (and then if that malicious thing was ever found, the blackhat can easily say, "Hey, I told you guys to fix it!! Now look what happened!! Wasn't me though!".
I imagine it's satisfying to help people and feel recognized (via group affiliation) for it.
what a __fake__ and superficial post.
Fix your god damn problem.
For Ruby there's Devise (email/pass based user management) and Omniauth (facebook, twitter, etc). Omniauth can also be used on top of Devise. There are others too, but I mention these two because they are popular and sufficient for most people. - https://github.com/plataformatec/devise and https://github.com/intridea/omniauth

For Django, there is Pinax Project - http://pinaxproject.com/
What's the karma threshhold before you can downvote comments? 200?
Please Google, when we search; avoid all tragedies through history unless we write the word "tragedy" on the search box... oh! and make sure that no search result for a business name returns sad search results; is your duty to help us believe that the whole world is a big happy shopping mall.
</rant>

Yep, my blood is boiling...
The Aetna Small Business policy I have requires a 90 day period before new employees are eligible for coverage. In the past, we have covered 50% of their Cobra payments from their prior employer or in one case, paid 50% of their current individual policy.

Florida requires employers to pay 50% of the health insurance premiums, but only for the company policy. I just figured it was the right thing to do as it is a benefit and it didn't seem right to shortchange people for 90 days.
I think the job I'm at now made me wait 90 days. It didn't seem too unusual. Well anyway they had a 90-day "probabtionary" period where either side could just decide that it wasn't working out and walk away, so I guess it makes sense to put off health insurance etc. for that time.
Github left the most widely known gap in Rails security open to exploit. Then they did a bad job handling the fallout.

I'm not saying the Rails devs shouldn't have changed it five (maybe seven now?) years ago when it first came up, but output escaping wasn't default until 3.x, and everyone in the community knew both were major problems.
"... pain point ..."

What is a pain point? Is it a problem? ... don't apologise I'm just looking at it like a n00b.

"... Any suggestions on how I can inform users what's going on without cluttering the page (pop-overs sounds like a good idea)? ..."

If users find it hard. A series of lo-tech screen caps showing a real example or a hi-tech video leading users through would do the job. Removal or explanation of any jargon. Seek feedback from actual users to get the best results.
Sent an email with some info :)
I respect your work Ken but I disagree with you on this.

I just want to give a huge nod of recognition to this extremely civil way to express disagreement. Bravo!
Have Arrington & Conway screwed up big time with their investment in Highlight?
Virtual Cooperation (VBPmafianaaz)
Virtual Instruments helps IT organizations maximize the performance, utilization, and availability of Fiber Channel Storage Area Networks (SANs) and other Online Services.http://www.virtualonlinejobs.net
Show HN: Thru the Galli - Directions with a human touch
This guy is in a shit situation but when I google "World Trade Center" and "Oklahoma City", the images of the terror attacks are among the first thumbnails in the general search.

Yes, of course they were both bigger events, but not so much in relative terms. This truck explosion led to the deaths of nearly 500 people, in one of the most gruesome ways possible. His resort is just a small resort...no number of decades is going to ever obscure such a horrific catastrophe.

That said, why didn't they change the name of the place? I suppose as late as last decade, Google results were not a big factor for most resorts. But better late than never, since presumably their brand and reputation won't get much better.