skysight-inc/HackerNews huggingface dataset:
This kind of discussion is lacking in the article. It seems as if the OPs goal is optimisation and of course finding the right algorithm with the lowest complexity is the first port of call. However, the indexOf function seems to rely on properties of the data which may not be present (like the forced example in the middle).

There are other algorithms besides KMP too for this. I'm sure with some thinking on my part the linear time suffix tree algorithms could solve this too off hand.
The scaffold Rails generates isn't insecure by default, it just doesn't automatically generate example cases that require input validation. Perhaps it should be laden with comments about how to validate input when your code does eventually require it.

You can't blame the framework for people failing to validate input. The framework can provide you abstractions for helping you validate input, but at the end of the day, if you're being lazy or sloppy about what you do with data from the outside, that's your fault, not the framework's.
What's up with the lack of capitalization?

p { text-transform: lowercase; }
You can be a virtual judge at the mega AngelHack hackathon.
Aye, that's where it gets hairy – I (or anyone else) could write equally impassioned blog posts for making him their chief security officer, or for suing him. The article starts going down the road of playing Monday morning quarterback with that issue, but it's short enough that it's acceptable. Not looking forward to the avalanche of posts on either side of the debate, though.
Do you really believe that suspending his account prevents him from creating another one for further exploits? (should he actually want to, which I doubt)
They suspended the account, they didn't cancel it. On a Sunday morning when you're fixing a security hole and you know who penetrated it you suspend that person's account. On Monday morning you figure out what to do with them.
I would go as far as to say every single [beginner] user of Rails too. If it wasn't for all this, I'd never have known there was a gaping exploit I'd need to patch up in my own app in development.

This, in and of itself, is a major flaw in their documentation. It's like PHP's mysql functions not mentioning escaping strings on their manual pages, but instead burying it all entirely elsewhere, where you'd never think of looking.

"You should have read every single page of the documentation, then you'd know we briefly mentioned mysql_real_escape_string() and prepared statements that prevents this issue."

I mean, the least you can do if you won't provide a fix, or sensible defaults, is to make it abundantly clear you have to correct it yourself. (Bit of a broken record with this schtick, sorry!)
I would disagree with this, quite a lot. He brought up an issue with the Rails team, they pointed him at the canonical, "here is where we talked about this before, sorry." Still not satisfied, he found the same exploit in Github to prove a point. Rather than do the sensible thing by creating a dummy account and contacting Github showing how he messed things up, he barged into the Rails organization and left a silly commit. Github is first and foremost a business organization where lots of companies pay them lots of money to "take this shit seriously" and protect their data, so they did the right thing by shutting him down.
Privacy policies are not something I am intimately familiar with, but this seems like a problem that could be solved in a similar way to licensing open source software.

When I look at using a piece of software I quickly jump to the license, if it is BSD or similar I typically jump right in. I don't even have to read the terms because I know the BSD license. I would love to have a similar system for privacy licensing on various online services. Is there anything like this out there?

Seems like it would not be very hard.
> He did it under his own name, in a way dad not damage anything, using a problem that has been well known for ages, after attempting to draw attention to the issue several times and being ignored.

He was ignored by the Rails devs, not by GitHub. Yet GitHub became the target of his attack, because he was "bored" (his word, not mine).

At no stage, as far as we know, did he raise the issue directly with GitHub. As I've said in another thread, he could have done so and requested they disclose the fix publicly (say, within 24 hours) in an effort to force the Rails devs' hands. Instead, he's punished GitHub (who, mind you, probably should have audited for this vulnerability a long while ago) because he was shunned by the Rails devs.
They should hire the kid, not bitch about it.
So, by the same logic, twitter should allow javascript to execute when I view some post about people microwaving small mammals.

Perhaps I should be more explicit.

My problem is not with the abilities to assign pixels to an output device. Email should not be an interactive proposition and should have no ability whatsoever to run code.
Here's a reverse interview question I'm toying with. One question I've had a few times is "Give an example of a time when you've had conflict at work?" - or variations on that theme. After giving the normal canned response I like to add:

1. You're asking because there is the normal amount of office conflict in your work place?
2. You're trying to build a "Team of Rivals" company culture like Barrack Obama in 2008 i.e. making Hilary his secretary of State
3. You're giving me a coded message that there are genuinely prickly personalities and a lot of conflict in your team?

Number 3 is the real question.

The good thing about asking reverse questions is that you can avoid getting bad clients and employers. The problem with asking these kind of questions is that it puts the employer on the back foot and is unlikely to result in a job. It will depend on how much you want the job I suppose.
Of course. I can't imagine that I'm the only person leaving GitHub because of this.
Review: Service Design Patterns
GH is playing to two audiences here. The hackers agree with you, but the corporate types (those who play by the rules) don't. GH stands to lose more by alienating the naive mob who think banning the account makes an iota of difference than it has to gain by trying to please the rest of us. GH is acting risk-averse with its PR strategy.

My prediction: Egor gets a job offer from GH within 2 months.
We have some team members who aren't so command line savvy(don't ask why). I recommend source tree to them and they are quite happy with it (which means others can work without interrupts). It's a decent app for basic/everyday things.
I hadn't tried it before, but VLC 2.0 is a very impressive improvement over 1.x. I don't have an extensive library of files with crazy features, but it handled everything I threw at it fine. Hopefully they'll keep improving, it's good for the other players to have more competition on features.
Brilliant idea. Would be a great project for some law students somewhere if this doesn't already exist.
Just because the information is useful, that doesn't mean it is ethical to collect it.
When Giles is Right, He's Right
Strategic onanism. LOL
Ask HN: Would businesses pay to identify "Connector" or "Maven" users?
At our startup, we've developed an algorithm that analyzes your Facebook friends and the connections between them to determine your fraternity and sorority. We find groups of friends in which everyone is friends with everyone. The algorithm runs in less than a second for ~1000 friends.

We've seen tremendous success, one sorority girl will sign up and the algorithm will accurately list ~150+ girls in her sorority given just her friend data.

Though we're now considering a pivot to offer a B2B service in which we'd identify "Connector" or "Maven" users. Connectors/Mavens are the special types of users that help spread the word for your product and the users you want to provide special attention to, e.g. customer service, special offers, etc.

We'd also help you identify the key people to invite to your site. So if John is friends with a Connector, we provide you the code to put on your site to invite this Connector.

---> The burning question:

Would businesses want this? Would they be willing to pay? Is this a clever application of a powerful algorithm?

Our algorithms run in real time essentially so we're convinced we're opening some new doors. I apologize for being intentionally vague :)
Or you can use bitbucket.org (using Django :-) which has git support and private repositories for free for up to 5 developers.
The main question is, with all this technical skill, are they going to release any films of their own?
I, too, agree with your sentiments. But I wish people would lay off of GitHub. The were mostly just a bystander here.

The real troublemakers are the Rails developers who seem to seriously believe that leaving such subtle security traps in their framework (and then blaming the developers who follow the example code) is a defensible position.
Why It’s Important to Talk Math With Kids
The one "good" thing that comes out of this public exploit is that github was the target.

Github is obscure enough to non-developers but quite well known in the development circle.

This means if you are using github you probably have a damn good idea what the vulnerability is. I'm not a rails developer (mostly python/django) but I get it immediately. This is mostly an issue with the framework helping me shoot myself in the foot.

Sure it's in the documentation. But realistically a good framework gives me sensible defaults so I don't have to refer to the documentation. I trust the framework does the "right thing".
Are you planning to unban him later?

I see why you'd want to suspend his account while you are fixing the hole. And I can see that it sucks that you got caught in the crossfire. And that reporting the bug quietly instead of announcing it to the whole world would cause much less headache.

OTOH after reading the rails bug report I think that homakov's only option was to make a high profile demonstration and basically shame the Rails devs into fixing it. I realize that it's incredibly shitty for you, but I'm afraid they'd just write it off if he kept it quiet.
Hey Github, Remember This Article?
He violated the TOS, if they didn't suspend him I would question hosting anything with them.
I'm no Rails expert, but I tend to like the OpenBSD philosophy: if you ship with default options that are known to be insecure, you have a security bug.

I know security is always a trade-off, but when your largest and most famous testimonials, with all their mad skillz and street cred, still manage to get it so spectacularly wrong, it's clear that the core engine is as guilty as any other component.
He notified Github "last Friday", according to them:

https://github.com/blog/1068-public-key-security-vulnerabili...
Github was right to ban the guy. He did hack them roundly after all.

On the other hand, he did it in a largely non-malicious way and even managed to expose those Rails knuckleheads for the greater good.

Github should find a way to let him back in, intentionally. Perhaps they could offer him to create a new user and they could give him some of his repositories back (if any were important).

Edit: It appears Github has in fact reinstated him.
Perhaps these conditions are not mutually exclusive. It can be an attack, and, something done with good intentions to illustrate a point.
Funding Guide For Home Improvement
I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, except that the former would probably get the bug fixed quietly; in contrast, now everybody is aware that the bug existed in Github and is aware of the potential for it to exist everywhere. He successfully proved his point, which apparently was a pretty good point. Isn't that a better outcome?

As for Github's responsibility: Github failed to protect people's data the minute the bug went live. That data was open to Egor since the moment he discovered the bug until the moment they fixed it. Making a silly commit did not make anyone's data more or less vulnerable, so I don't believe that "taking this shit seriously" implies flipping out over it.
I disagree. Github is very much not the bystander here. They chose to use Rails (which is fine). But GH then has the onus to properly deploy their app.

An analogy would be a door that only locks with a special key in a certain sequence. IF you choose not to do so, it's merely a door. Obviously, you could argue that that's a bad default but I think that goes to the crux of the problem.
Whitelist_attributes functionality for existing Rails apps (2009)
C# should be truthy-y
I've always thought it would be teh awesome to be a calico human, if for no other reason than I could snort derisively at human racism.
That is not clear to me at all. Why do you say that?
This guy could have stolen several codebases, but he decided to prank rails team.

Imagine things like instagram, path, evernote and so being seeded in thepiratebay, this is a FCKNG serious and insane issue. I have my entire copyrighted research and codebase into github.

Im really pissed about this issue and considering to move away from github =(
Did Zed do that on purpose, though? He was continuously added to a troll repo with no way to block the guy, so he spammed his repo with commits and fake branch merges, but I don't think he crashed GitHub on purpose.
You should check out http://bitbucket.org
Do people actually host confidential code on Github, vs. open source projects? I'm worried about the integrity of open source projects, but not really their confidentiality.
Or basically this: http://www.engadget.com/2011/08/14/asus-eee-pad-slider-shows...
If they suspended everyone who could be suspended under the TOS no one could host anything with them.
Good for Egor Homakov. I don't necessarily agree with his methods in this case, but in the end, the net result of his actions was positive for web security. And as so many others have pointed out, when the proper channels aren't working, sometimes a little spectacle is just what you need to instigate change.

In other news, I'm not sure why the rails core team was so against this in the first place. Making things safe by default is usually a good idea. This change doesn't seem to add too much additional ceremony, and people had been asking for this for some time.
Two of the firm's investors are buying more shares in the company, and the valuation is rumored to be $700 million. How is it clear that it won't have a place in the future when those two data points suggest something very different?

I'm not a user of FourSquare, but the comment struck me as far from a fact.
Although not free, I've been using Tower a lot lately for Git, even though I had used the command line interface for the past few years. I just find it a lot easier to divide chunks of work up into smaller commits using it rather than on the command line.

http://www.git-tower.com/

If you're a vim user, then vim-fugitive is also worth looking at!

https://github.com/tpope/vim-fugitive
If you read the Github advisory, he did indeed raise the issue with them "last Friday":

https://github.com/blog/1068-public-key-security-vulnerabili...
I learned some new stuff about CSS! Motivated to create my own mobile web app now. Thanks for the in-depth explanations.
It seems reasonable that Google's algorithm is listing those photos because it's finding that a number of people searching for "Camping Alfaques" are looking for photos of the explosion. So it's just giving those users what they are looking for.
Yeah there's a guideline on "editorialising in the title"
> His previous report was fixed last friday

Makes it sound like a separate issue.

edit: looks like github clarified https://github.com/blog/1069-responsible-disclosure-policy
p3p [http://www.w3.org/P3P/] was based on similar intuitions. If there were a small number of frequently used policies, you could take things one step further to formally describe these policies and even build software to help negotiate: what information are you willing to share given this policy?

It turns out that privacy policies were too subtle and varied and hard for people to understand for this to work.
I'm not too worried about the ability of an attack to push a commit, or cause a commit/object deletion in a repo's history, on GH, because most smart folks (if not everybody, by default) will have multiple copies of a repo across multiple machines, with backups, so anything can be undone or restored. (And trust me, I have the imagination to understand how an unauthorized commit/push could lead to a situation enabling remote execution on client machines who've pulled down tainted commits. Think build scripts that have "install rootkit/malware/keylogger" commands added to them in the mal commits.)

What would be more bad is if this vulnerability allowed an attacker to get unauthorized read access or pull/clone access to a private GH repo.

Can anyone clarify for me whether this was possible?
Is anyone else laughing at how ridiculous this vulnerability is?

I just spent a few hours last week hacking through the Stripe CTF game. Environment variables, string formatting injections, and a timing/side channel attack to top it off.

This is just POSTing a value to an endpoint. And it gets written?! To the database?! That's awesome and scary at the same time.
Seems strange that Active Record doesn't have an "update_fields" method with sig array of updateable fields, hash of field=>val. Similar to Sequel.
During my interview, I was never asked for permission to allow them to view my search history nor do I think they would want to know. Who would want to work for a company as creepy as that?
That's a ridiculous statistic purely contrived for a sensational headline. If you want to a more reasonable measure than you should count the number of sites where users are giving personally identifiable information. Those are the sites where policies should be read and that will be a much smaller number.

Given that, I do think privacy policies can be more concise, but that likely won't happen with out some sort of tort reform. Policies are long because businesses need to cover all of their bases in a litigious society.
I am sure we can have a non-smoking event there. IIRC Between 19:00 and 22:00 no smoking is allowed in the main hall.
OK I haven't been able to find that $4K/year thing. It may have come from here:

http://www.edmunds.com/mercedes-benz/m-class/1999/consumer-r...

where the guy talks about spending $5K in one particular year, which appears to be the first year he had it.

likely an exaggeration on my part, mea culpa, but the reviews on that site are full of maintenance complaints:

http://www.edmunds.com/mercedes-benz/m-class/1999/consumer-r...

it's entirely anecdotal but I had a friend who had two BMWs and both were constantly in and out of the shop. this was a long time ago, though. ymmv (literally).
> I honestly don't see the meaningful difference between contacting Github and leaving a silly commit, except that the former would probably get the bug fixed quietly; in contrast, now everybody is aware that the bug existed in Github and is aware of the potential for it to exist everywhere. He successfully proved his point, which apparently was a pretty good point. Isn't that a better outcome?

I'm not denying that by doing what he did it certainly got the word out and made everyone understand how serious of a problem this is. It was a very good point and I think the outcome is the right one. I'm just saying that Github's actions - to suspend the user who somehow got SSH rights to the rails org - is the right thing to do. They want to minimize his damage that he will do, and until they can do a full audit and understand how his commit got there, it's the right thing o do.

> Making a silly commit did not make anyone's data more or less vulnerable, so I don't believe that "taking this shit seriously" implies flipping out over it.

I fail to see how suspending a user is "flipping out" over it? I don't think you can color unauthorized commits to github repos with different levels of responses from Github. That's a dangerous line to walk IMO.
This is probably the perfect time to switch to http://bitbucket.org/ . They offer free unlimited public and private repositories for both Git and Mercurial. However, the free private repositories are limited to five collaborators.
I'm an experienced developer, but not terribly familiar with Rails.

What do you mean "properly deploy their app"?

The sample code at rubyonrails.org looks like it has the same problem to me, i.e., it would be vulnerable if it were put into production in the right (entirely reasonable) circumstances.
Responsible Disclosure Policy
Presumably he took quite a bit of money off the table in the secondary that went down last week. Good for him.
For services that don't allow you to have your emails delivered as a "digest" I created http://emaildigest.me/ that allows you to create a digest by setting up gmail filters.
Thanks man, I can't upvote this enough. I stumbled on the video posted in [1] and now I can watch it.

[1] http://news.ycombinator.com/item?id=3637983
According to https://github.com/about, they have 59 employees and have never taken VC. Since the opensource projects don't pay, the math suggests that yes, quite a lot of organizations are paying to host confidential code.

FWIW, we do.
Author Identification - Surprisingly Accurate, Sometimes
I prefer to pay someone to host the private repos. No free tier means every user is treated like a paying customer, and every user's data is considered valuable. It also means that as long as the pricing is sane, the company isn't going to shut its doors for lack of revenue. Before RH I was paying Springloops.

It's $6/month to take care of my most important assets. That doesn't even buy a meal at McDonalds anymore; it's worth it.
Wow, that's the worst my iPad's keyboard has ever bitten me. Umm, let's try again: "a strong need for a theoretical background".

I had a feeling I should have proofread that one. The small box makes it annoying, though.
I'd like to see the numbers for licenses in general (and particularly accounting for how often various sites' licenses change). I've written before[0] about how Apple's iTMS policy is long and frequently updated and that they clearly have no expectation that you'll actually read it or even be able to.

[0] http://www.blahedo.org/blog/archives/001060.html
It seems they had previously mandated Xvid, which is very much a conforming implementation of MPEG-4 part 2 (for that matter, DivX has been since 2001.)
From an old text file I have laying around:

Scene groups are known as affils or affiliates
when they release on a FTP site. When they release
something..racers and traders start racing
that release to other FTP sites at Gbit speeds
using auto mated scripts.

When they Release something on a ftp site it is
known as to pred or a pre. pre means the
release is ready to be raced to other ftp sites
NOT torrent sites. Remember all scene groups
hate torrents and do not want ANY of their stuff
on torrent sites. If they see someone on their FTP
sites releasing stuff on torrents, his ip gets
banned and he gets NFOed sending a warning to
other FTP sites to delete purge him and never to
allow him anywhere near scene ever again.
The answer is, you wouldn't if you're concerned about privacy. DDG delivers decent enough results and part of their philosophy is that they claim not to track users.
His account has been reinstated, Github has patched their service, and the Rails team has committed a patch with new defaults. All in less than eight hours. Let's move on.
I like the part where the Rails developer says:

The user has a flag to secure by default, I personally think that is enough. https://github.com/rails/rails/issues/5228#issuecomment-4300...

In other words, Rails actually does have a flag to make the mass assignment feature secure by default. But this flag defaults to 'false'.

https://github.com/rails/rails/pull/4062/files#diff-1