skysight-inc/HackerNews huggingface dataset:
> system bootup was controlled by a bunch of shell scripts that made no sense to me

And this is the problem. You're guilty of the very thing you're accusing the author of.

Some of those shell scripts are very simple and can be easily replaced with a configuration type file. Most are not. They do a ton of stuff, like create lock files, pid files, check for dependencies, check for existing processes, etc etc and couldn't be properly replaced by a configuration block.

Using shell script gives you unbelievable flexibility in how you start a daemon that can never be replaced by a configuration script.

So what happens? All that complex stuff stays in that script you can't understand and now you've added an additional layer of complexity that wasn't necessary.

Every additional layer adds a point of failure and in my humble opinion, isn't worth the additional user-friendliness.
Honest, just, trustworthy, good, happy, well behaved humans? That would be great.
Space Noodles Visualizer [HTML5]
http://www.sendgrid.com/ which provides email services to a lot of clients perhaps uses this by default. I don't think people in this business look at it as an attack. Websites use various techniques to track people's activities, and this is just another one of them.
He has a get out of jail free card.

http://homakov.blogspot.com/2011/07/octocat-tattoo.html
I'm not sure a frat-ish vibe is the best way to accomplish that, though. In particular, I don't think cultural geekness is the problem; women are fairly well represented in cultural geekdom outside of programming, especially in recent years. For example, most sci-fi/fantasy fanfic authors are female, and gender balances at general-geekness conventions (e.g. Comic Con) is closer to even than it is at specifically tech events.
"It's thinner and lighter than an iPhone from everyone who's compared the weight"

Apparently these people didn't have a scale, as the iPhone 4S is 140g and the Note is 178g.
Visual Event visually shows Javascript events on a page
Can you not see that to many people, suspending Egor's account looks churlish and petty.

It's bad PR with your core demographic.
Well, I suppose protectionism does have to have some unintended benefits for the rest of the world.
Why is someone who can hack Github working for $30/hr on oDesk? @Egor, quit selling yourself short!
Yes we're all nerds carrying around TI89s on our belts, and still coding in FORTRAN...

I find this image of regular programmers nearly as offensive as the faux geek imagine hipsters try to acquire while wearing cheap prescription glasses they don't need.
Don't forget debugging and reading error messages. I honestly believe that 90% of learning any language is learning how to solve errors when the compiler or run-time spits them out at you.
It took me 15 minutes to figure out what was going on. Before someone reproduced it you'd be 15 minutes on. It worked for those 15 minutes.
If the only activity he's done is what he's mentioned in those issue comments - he really needs his account reinstating soon.

There was no malicious intent from those comments - and he's done you a favour.

If his account doesn't get reinstated - Github has become something I didn't think it would whilst the founders were still in the business.
Pandoc http://johnmacfarlane.net/pandoc/index.html can do that and much more.
Shameless plug... just use HelloFax and skip the entire printing and scanning part anytime you have to fill out a form.
> Why do you think they are called racers?

They're not. Cappers and racers are different people. It used to be that racers weren't even affiliated with the release group, just people moving stuff between sites for upload credit.

> Who would have to X?

The same person would have to do all the work involved in making a release. Usually, there's a division of labour: different person provides the source, someone else encodes it, someone else takes care of coordinating the release and so on.
I like The Secret analogy. I use goldrush. There were all kinds of theories popping out all the time, but the ones that made the most, were infrastructure providers.
Take the offer. It might come in handy 15-20 years later, e.g. you might decide to get a graduate degree in some other field, and you don't want the lack of a degree to be the obstacle.
You can still use shell with systemd; just replace the "ExecStart=" binary with the name of your script. I've seen lots of systemd unit files where the ExecStart and ExecStop lines just shell out to the old LSB init scripts.
Peter Gutmann reported some interesting studies in his keynote talk at Shmoocon this year. It's probably available on Ustream or the Shmoocon site.

In short, sometimes darkness helps. Consider a tall glass office building. If all the lights are out, nothing stands out to a security guard more than a flashlight waving around in the darkness.
I think from a PR point of view with respect to the rest of the developer community you might have lost this one. You didn't eliminate the threat posed by him as an individual because he can create a new account.

(Note: as far as your enterprise or big-corp clients, you probably did the right thing, because that is what they would have done and that is what they expected. So if they are the clients who put bread on your table, then you have acted correctly)

What I think you could have done better (and I speak as a developer not a corporate client): issue a public note saying something to the effect of "Thanks for finding this out, maybe you'd like to interview with us. But please, everyone, do not do it this way, this is against TOS and most likely illegal. Here is is the email where to report these things and we will make sure to give you full credit after we fix the problem".
What to do if a bomb / drugs are planted in your luggage?
So the scene: You're flying from Bogota, Colombia to New York, USA. You arrive, pick up your bag from the carousel, and figure you'll stuff your netbook you used on the flight into your bag now rather than lugging it through the airport under one arm.

However, when you open your bag, you see something that you certainly did not pack. Drugs/a bomb/live snake, take your pick.

Now you didn't pack these, but you're pretty sure the guys ahead who will x-ray / sniffer dog your bag won't take kindly to seeing them there. What are you supposed to do in this situation??

(Note, while this has not happened to me, it's certainly claimed to have happened to several people travelling from Bali, Thailand and other places - see the Schapelle Corby case for an example)
Internal scene transfer was (and still is, afaik) done using FTP servers, often very primitive ones because they had to evade detection on hacked servers. When you're racing a large game or movie from one server to another, the last thing you want is for a random disconnect to ruin it 90% of the way through, or even worse, to finish it and find that the CRCs don't match because of random corruption. It also means that you can race from multiple sources for higher speed, and like you said, use a server as a source before it's actually done downloading.
This is a fairly recent development, but VLC 2.0 will play just about anything out there, on any of the big three operating systems.
I think you're confusing Ruby with Rails. Flat out refusing to learn a wonderful programming language because you don't agree with it's dominant web framework is silly.
I wouldn't even play it with myself ;-)
I agree. I would at least like to see a demo before taking the time to login with my own twitter.
Although it's risky to impute motives, I really think it was intentional that he pwned...

_rails_ _git_ _master_
So, in summary, we can't clone tortoiseshell cats because we can't clone their patterns?

In that case we can't clone anything - identical twins don't have identical fingerprints.

This also ignores the problem of "active" chromosomes (even though it relies on it). Well sure, you'll get one that's active, and that can't be used directly to clone a tortoiseshell cat into another tortoiseshell cat - but that will only be true until we can reactivate the inactive one.

A cursory glance through Wikipedia suggests X-inactivation isn't a well-understood area of genetics, so I propose it's not an actual limit, but that it lies beyond our current "limit of understanding". Calling it impossible is pure conjecture, but probably makes for a more link-baity article.
It's public, I'm pretty sure I got there before logging into Google this morning.
New Senior Dating Website
New senior dating website, we have millions of singles through out the UK. Our site also has blogs to assist people over the age of 40 to find, build and maintain their relationships.
One upside of using mp4 is that most smartphone devices and tablets support it.

No more transcoding from xvid/divx.
Entirely true. And that person is at the mercy of their governing law and the company's ability to pursue and press charges should they decide to take matters into their own hands, regardless of intent (unless their governing law takes intent into account).
> It could also be to reduce legal culpability.

Ok that makes sense. In light of that they most likely acted rationally and correctly.
Hi,

I might have some interesting projects for you. Can you email me at hn At machine Dot imap Dot cc? I couldn't find an email address in your profile.
This is NOT a vulnerability in Rails. If you've ever used Rails, you'll probably be aware that it has several features for preventing things like this from happening (attr_accessible, attr_protected, etc). GitHub failed to use those methods, so it's a vulnerability in GitHub. All sites powered by Rails are not necessarily vulnerable to this, only ones that have not been properly coded using the aforementioned security features.
And your answer is thoroughly irrelevant. For the same reason, you can't use an iPad because it doesn't have classic unix environment tools.
In Germany we have the CCC, they provide legal advice for these cases and have a ton of experience.

Do you have something similar in the states?
"This is why I refuse to learn Ruby. I don't want to be associated with that community. "Learn Ruby if you want to be
associated with a bunch of people who call themselves
Rockstar Programmers.""

You refuse to learn a language due to how a project acts? Have you ever read the {open,free,net}BSD or Linux mailing lists? You're not going to make it far in software development with an attitude like that.
Maybe you can try reading glasses? Seems like a step backwards to wear glasses again, but they are made to correct vision problems.

I can't convince myself to get LASIK or a similar procedure. I've been wearing glasses pretty much every day for more than 15 years too. Being a developer as well, I don't want to risk my sight. I know doctors will always tell you LASIK is a safe procedure, but there's always that small chance that accompanies even the safest surgical procedures, and glasses have worked every single day for 15 years.
As well as being an uber-geek who was head-hunted by Google, Neil is a bit of a Meccano guru. Here is his blog post about building a 3G centrifuge to see if lava lamps would work on Jupiter:

http://neil.fraser.name/news/2010/03/03/
The "they" in this case being the Rails team and not Github?

A common thread here seems to be grouping Github and Rails.

Its interesting how bring up their Terms Of Service gets discounted and the holy war just takes over. No where did I mention Rails, Ruby, community, or anything else.

Me: He broke the rules.
Retort: I like plant.

Disclaimer: The actions of individuals are representative of individuals. Drawing dramatic generalizations accomplishes nothing. Yes, there are more vocal asses in every community. For every asshat there is likely 100 quiet people. Right now, I'm being an asshat.

Gee, homakov is Russian. All Russians must want to hack your site. Really? No, its a dumb generalization.
GlaxoSmithKilne Ventolin Inhaler
USA -$41
Ireland ~$10
France -$10
Canada - $10
Do you have any idea how much it costs to clean up after an "intrusion" or "data breach"?

Of course, it's unfair to blame all those costs on the guy who had to go as far as actually escalating his privileges in order to unmask the Rails developers for being such knuckleheads.
Call yourself a brogrammer? Let's hang out.
From the linked blog post by homakov:

Since guys in rails issues ingored me and my issue I got spare time to test
it on the first website i had in mind. github.
That was pretty funny. Firstly, I could write post from 1234 year or 4321.
Then, I could make a post pretending i am DHH. That was funny too.

Then I could wipe any post in any project. That wasn't that funny but pretty
dangereous. It got more curious.
Today I can pull/commit/push in any repository on github. Jack pot.

Hence my implicit assertion that this is broader than commit access (via public
keys) and has nothing to do with cryptography/public keys itself.

To be fair, in the first sentence of the github blog post, mojombo goes on to
more precisely state "a security vulnerability in the public key update form",
but it appears that this may not be the full extent of things. For an example
of the other vulnerabilities homakov mentioned in his blog post, see [2] where
the contents of an issue was changed.

[2] https://github.com/blog/1068-public-key-security-vulnerabili...

(Edited for formatting.)
This could be trouble, someone get Micheal Bay on the line...
Everything about the scene is for non-torrent sharing (atleast public / largescale distribution). The scene groups hate public torrent sites/users.
That's a very good point about there not necessarily being a right answer. Though of all the companies in the world, Github is one of the easiest to get in touch with their developers.
Elgan: This year's mobile screens will stun and amaze
This is the upstream of the public bittorrent releases- and they still do lots of strange, unfashionably archaic stuff.
As the question about what it does at core level is not completely answered, the difference between :2 and >> is 175 versus 6 cycles in the processor.
It sounds like the Asus Transformer[1] is most of what you want (and also a nice tablet).

[1]: http://eee.asus.com/en/eeepad/transformer/specification/
The archives has to be assembled into one file with at least two encoding passes, is that even possible if you don't have the entire show captured?
My personal experience with writing sysvinit scripts agrees pretty well with s_tec's view. Those shell scripts would easily have been replaced by trivial .ini files and contained several bugs before I managed to figure out how to use start-stop-daemon correctly and fix some typos.

I have not used systemd myself but it seems trivial in comparison to my experience writing sysvinit scripts.
Exactly what, exactly?
If it affects "Hello Rails" the canonical example Rails application, then maybe it is arguably a vulnerability in Rails.

http://guides.rubyonrails.org/getting_started.html#say-hello...
Ask HN: How to evaluate a hotel's wifi connection in advance?
I'm on the road a lot for work. I tend to end up staying at a lot of budget chain hotels that offer free wi-fi. So far so good. But sadly, not all wi-fi is created equal. The past few weeks I've been subjected to a particularly shameful string of terrible connections, and I've decided to try to take matters into my own hands and research the speed/quality of a given hotels connection ahead of time...

... only to find that there is absolutely nowhere on the internet that this is discussed at all. I would think that, by now, some enterprising traveller would have created a listing of some sort, which, even if not comprehensive, could be a start. But I'm coming up completely cold.

And so I turn to you - does this exist? If not, do I have any other options for researching the quality of any given hotels internet other than trying to skim 200 tripadvisor reviews, most of which are probably faked?
I'd be interested in how many people are actually tracking the users with it disabled (Remember that Google Analytics can't track them since it uses JS)
I agree, except about C++, and PHP is kind of a mess, not what I would use as an example of a simple and logical language.
FXP http://en.wikipedia.org/wiki/File_eXchange_Protocol
Atlassian: Please spend less time reinventing the wheel and more time on integrating git and mercurial into Jira Studio/Atlassian OnDemand. The existing integration is quite lacking, and the community has been incredibly vocal about it: https://studio.atlassian.com/browse/JST-2090
Cool idea, might give it a try in the future.
That's certainly true for the code, but Github is more than just that. Think of the commit-comments, issues, pull requests, private messages and wiki pages. I guess you could create backups of most of these things with the API, but who does that?
Indeed, github, Ruby and Rails are all different things. I do recommend approaching language/platform/tool choices form an engineering rather than a social point of view.

Don't get me wrong, though. I can see being turned off by rockstars, but you've found a language unencumbered by them?
Strange that the post's title changed from "may be leaving" to "is leaving", though the content still says he "is likely" leaving. Is it confirmed or just conjecture?
This is definitely a first step.
The thing is that with 'attr_accessible' a lot of interaction with your models gets harder (think testing or working from the console).

I tried fixing this with introducing roles that have access to all attributes. Source at https://github.com/eval/sudo_attr_accessibility
Get your eye examined, maybe you need lighther glasses.

I opted in for contact lenses, I feel "whole" with them without the expensive surgery and I can adjust them to my eye every six months.

If you don't want to go back to glasses but need sharper sight, then I would recommend wearing contacts.
Immediately having problems saving Remote Repository Settings. Just won't save a new Remote Repo.

Buggy as...
I think the io9 author is striving here to emphasize a favored, romantic conclusion: "No matter how advanced the technology, there is no way to clone a certain kind of animal. Life is sometimes determined to be unique, in spite of our best efforts to make it predictable."

I expect it's equally likely a way to reset the X-linked-inactivation within a single cell will be discovered, so while the coloring of the clone won't be a perfect copy, it will be a product of roughly the same random process as the template cat. (Perhaps the reset would even be possible in adult cells: give your cat a pill to rescramble its colors over the course of a shedding cycle, or force it one way or the other.)

Of course there are all sorts of other confounding influences, such as horizontal gene transfer and chimerism, both of which will probably turn out to be more important than usually assumed. But given a few hundred years, the error in 'cloning' an organism can likely be made almost imperceptibly small.
More like:

"Dear Grabastic,

Today we had a demonstration by a user (xxx) of a security vulnerability on our site.

${VULNERABILITY_EXPLANATION}

We believe that it is possible that your application or records are covered in the scope of the exploit, because of the fact that ${VULNERABILITY_APPLICATION}.

In order to fix this issue, we have ${VULNERABILITY_PATCH}.

We have thanked this user for their vigilance in spotting bugs and security weaknesses in our site, and they have been added to our contributors-security page here (link).

We have a stance that security is something that can only be improved by lots of inquisitive eyes, and so if you have seen any issues that concern you, please do not hesitate to inform us and/or demonstrate the vulnerability--provided, of course, you do so without breaking anything permanently. :)

Our service is better today than it was yesterday, and we hope that with the patience and openness of our users it will be still better tommorrow!

Sincerely,
angersock
"

See, not so hard!
Why I’m Building Simple Tools to Help Market My Web App
How has he hacked Github? He's a contributor on rails/rails see here and search for homakov - https://github.com/rails/rails/contributors
One man's quest to purge horrific pictures from his Google results
I just checked using a proxy -- there are no calls made to Facebook from gmail if you do not display images. (Checked using Chrome on a Mac.)
Inconsistent error handling, for example. Why do some functions fail silently, some functions return false, some functions produce warnings, some functions throw exceptions, and some functions tell you to call another function to retrieve the error code?

Ruby and Python are much more consistent in that regard.
What are you talking about? Do you think the cappers are seeding the torrents themselves?

A lot things happen before you start leeching from tpb...
Somehow, this is a terribly amusing comparison.
Not all security vulnerabilities can be protected automatically by a web framework. In many cases, frameworks provide features that developers can use themselves to secure their applications.

Example:

XSS is a common web security problem. In short, it means that putting user-originated data back on the page unescaped is unacceptable. Before Rails 3.0, the Rails approach to this problem was to provide a helper (h), which you could use to escape content that you knew to be vulnerable.

Unfortunately, many Rails users did not use this feature in all places they should have used it. As a result, many applications (Twitter included) suffered from whack-a-mole XSS vulnerabilities.

We were unable to solve this problem in the 2.x branch, because automatically escaping all text being put onto the page would be a massive breaking change and would break every app in existence.

Further, simply escaping all text would not really solve the problem. For example, the "<form>" tag generated by Rails itself should not be escaped, while any of its contents or attributes provided by the application should. Asking the user to take on the responsibility to mark Rails-generated content as not needing escaping would reintroduce the same problem we had before: people would "unescape" things too eagerly, and apps would tend to have vulnerabilities.

The solution was to release a plugin for Rails 2.3 users (rails_xss) and change the default in Rails 3. It isn't perfect: there are still cases where applications have to mark strings as "safe", and applications that have to do so often might have the same problem, but I think we did a good job, all things considered.

This case is quite similar. Rails provides all the tools necessary to have a secure application (attr_accessible is the equivalent of h), but many apps don't use it correctly (or at all). In short, a Rails security default seems to be wrong, insofar as "wrong" means that many people fail to use the security feature, causing their applications to be vulnerable.

As with the XSS feature, fixing this problem requires some thought. Simply changing the default would break a lot of applications in the wild. Like XSS, it's probably correct to do so anyway here. However, like XSS, we should make sure that we have done everything we possibly can to mitigate the additional cost associated with complying with the new default. If it's too painful, many people will overeagerly bypass the feature, reintroducing the very issue we were trying to protect them from.

In this case, I have proposed a solution that I think will mitigate a lot of the problem (https://gist.github.com/1974187), and we will likely ship it as a Rails 3.2 plugin. This will allow us to gather feedback about unexpected consequences and ensure that when we change the default for Rails 4 (which has not even shipped a prerelease yet), it actually mitigates the security problem in the vast majority of Rails applications.