skysight-inc/HackerNews huggingface dataset:
I never said this is a security vulnerability in Rails.

I said it is a bug (and a serious one).

A bug, as you may be aware, is a mistake, fault, failure, problem or other unintended or surprising behavior in software.

See updates to my post for some additional clarification. I hope that helps. Thanks for reading!
I think you are onto something here. However, for this to be more useful, you need to also ask which industry/position the user's in. "Distractions when working" is too general to develop a product. However, if you know this person is an "air traffic controller", then you can start thinking of a problem solution -- technical-oriented or not.
Did you read a different article than I did? Did you read the whole article? Aside from one Nanny Net spokesman, nobody was asking for anything to be hidden. I think it is perfectly reasonable to ask why "accident camp abc" doesn't show grisly pictures, but a more generic "camp abc" does show them, especially when it only started a couple years ago (was somebody hiding that information for Google's first ten years?).

If it were my business that were being torpedoed by search engine capriciousness, I'd raise a stink about it, too, it for no other reason than in hopes it would push the stuff lower in the result stack.
Home Help
Home care, home help, home assistance and care in the home to all age groups to the highest possible standards from a private homecare company in Dublin.
Realistically, how often does this happen though? Even my worst enemies wouldn't unsubscribe me from a mailing list just to piss me off. Plus, anyone I forward an email to is probably an acquaintance who wouldn't do that.

The benefits of 1-click unsubscribe and not receiving additional unwanted emails outweigh this small chance of being unsubscribe from a list I want to be on.
Have her create a list of value propositions she can offer a company. Start from there.

Oh and I'd recommend scoping out potential fits and figuring out how the match up would make sense. Basically any company who's hiring is looking for a ROI > 1.0. If she can prove that the ratio is significantly higher than 1.0, it shouldn't be a hard sell, especially if she has a warm intro.
Hotel Booking
Hotel Booking Offers is a detailed travel search engine, providing you with all of the last minute deals on choice hotels and the cheapest flights available through online booking.
I just use filters, much easier and less of a hassle in case I need something from the things I subscribe to.
Have you ever traded? If so, where, and for whom?
try leaflet, and if you have a limited amount of data points you may just want to load them with one chunk of json/geojson and forget geospatial querying
I don't like the suggestion. It enforces a 1:1 relationship between controller and model.

I'd rather have the model and the ORM be pulled apart and the model make this distinction.

Or create another class that knows how to safely pull values out of a params list and use it to create a model.

But it's bad enough that the controllers "look" like they belong to a model in default Rails generators. This creates a certain amount of laxity in programmer's thinking. It boxes their thinking in instead of letting their thinking go free.
Pearson Airport Limo
Mobile Phone Insurance
Get Cheap Mobile Phone Insurance with covermygadget.co.uk in UK including cover for 5 gadgets up to £500 from £79 or cover up to £1,000 from £139.
Generic Drugs
Medicine Online Shop is a great online option as an online pharmacy where you can find the generic drugs also.
I know of two others in SF who are interested in this course. I'm sure there are more out there. If you're near the bay area and want to connect to form study groups, holler or email me at jkwon.work@gmail.com.
Precisely because there can be so many places (controllers) that can access the model, usually you use declarative access control rules on the model to control access in one place. It can be done with role. Then whoever user having the role can access the model.
Humimeter in Grubatec Ag| Strömungswächter
Ein Kalibrator wird vor allem in der MSR-Technik gebraucht. |Humimeter|Mit diesem Messgerät werden andere Messeinheiten überprüft, |Strömungswächter| und gegebenenfalls eingestellt. Es gibt mehrere unterschiedliche Kalibratoren, die für verschiedenste Messgeräte zuständig sind
After reading all this including your story,Personally I will never report any security or other incident to anybody(If I happen to find one).

Because no good deed goes unpunished. No one appreciates what good caused by your help.

It just bruises peoples egos and they violently lynch you for 'How dare you point a mistake at a genius like me, you should have tried whispering in my year'.

Its for incidents like this people refuse to help in not just security situations but also in emergency situations because you get entangled in unnecessary mess. People just let the world burn.
I should follow this up with this: as much as this sucks, and as much as I understand the guy's complaint and don't fault him at all, I don't see how Google can make a special case for him. However, google could look at the general pattern and ask "should we be putting pictures of tragedies up on the first page of results that aren't asking specifically about the tragedy?" That becomes a general algorithm question and not a specific search question.

I don't know enough about Google's internals to know if that kind of semantic information is available, but I trust if anybody could accomplish it, it's them.

I know if I was a parent of a victim of something like Columbine, I wouldn't want pictures of bodies showing up as the first thing 10 years later.
Zi Xiu Tang Bee Pollen Weight Loss Diet Pills-Natural Chinese Slimming
Authentic zi xiu tang gold bee pollen weight loss capsules for dream slim body!Healthy

bee pollen diet pills, no harmful side effects,see real success user's reviews here!
"The Rick Santorum Diet": hacking your health using campaign finance data
Scott Meyers (author of Effective C++ et al.) has talked about this subject many times (including in the aformentioned book) and it puts the ball squarely in the Rails team's court.

Let's make the reasonable assumption that your clients—the people using your interfaces— are trying to do a good job. They're smart, they're motivated, they're conscientious. They're willing to read some documentation to help them understand the system they're using. They want things to behave correctly.

That being the case, if they make a mistake when using your interface, it's your fault. We're assuming they're doing their best—they want to succeed. If they fail, it's because you let them. So, if somebody uses your interface incorrectly, either they're working hard at it (less likely) or your interface allowed them to do something easy that was not correct (more likely). This puts the shoe on the foot not used to wearing it: it means that responsibility for interface usage errors belongs to the interface designer, not the interface user.

Source: Scott Meyers: The Most Important Design Guideline? http://www.aristeia.com/Papers/IEEE_Software_JulAug_2004_rev...
Clearly this guy is someone trying to rationalize an argument against the fact that the search results for his business name can produce negative connotations.

The search engine is not a human being, it haves not capriciousness, and its not capriciousness from their creators neither; they just created an algorithm to give you the most relevant results.
Affordable Mobile Application Solutions from Perception System 
The issue of the Smartphone has more promptly improved the need for mobile applications that enables users to carry out their applications like web-based commercial and personal transactions and communications. This connectivity has ushered in new phase of mobile development.
Same tome? http://audioz.info/scene_faq.html
The funny thing is that Windows 95 was released AFTER Windows NT.
Torrent users freak out over shift from Xvid to x264
impotent blithering
That's an expensive future… Not everyone is going to blow their budget to make this one room.
Format for cv
GET YOUR PROFESSIONAL CV FOR FREE

Get your CV without having to...
Ask friends for help
Search for CV templates
Read articles on writing CVs
Just complete your Talent Profile...
...and we will write it for you!
I will usually just skim headers to get the gist of a policy if I'm dealing with a large entity. Only takes a minute and if there's anything terribly jarring I'll typically catch it.
I agree with the general principle, but it's very easy to overdo this approach. The difference between delegating and pawning your decisions off on other people isn't always easy to define.

Sometimes I'll say something along the lines of "My personal opinion is X, but this is your decision. Do what you think is best." You also have to be careful to prevent the Abilene Paradox from happening: http://en.m.wikipedia.org/wiki/Abilene_paradox
@wycats any chance of you creating a screencast of how to tackle Rails security from your experience with Merb/Rails?

Thanks again for your hard work and being a public voice on the issue.
Moser Baer launches credit-card shaped Zap pen drive, 4GB at Rs. 1,100
Global b2b marketplace manufacturers  b2b marketplace
Online B2b market place for your all kind of trade requrement. as Computer wholesalers, trade leads ,suppliers etc
Human hearts replaced by 10,000 RPM artificial pump with no pulse
s/programmer/web developer

And even then it's a stretch.
The followup question is, how much defensive medicine is necessary? If there's a 5% drop in that practice then do the costs from lawsuits go up to compensate? Are we at an equilibrium point, or are doctors doing defensive medicine because the myth of the power of a lawsuit is so strong?
Yep, same here. Sort of amusing to see some historical revisionism going on here from the E-E people.

I don't doubt that there were some genuine contributors, but claiming other's hard work as their own tainted E-E's brand for me.

P.S. For the young 'uns, Google Groups isn't. It is usenet re-branded. Google is now doing the same thing!
I linked to The Verge instead of PopSci mag since the PopSci article is not accessible from Australia.
Browsers Bugs, Tips, and Tricks
Has he been arrested yet? If not, I wonder why not. Github should press charges.
French Front Runner Proposes 75% tax bracket
Typical stubborn users who can't stomach change, even if it's for the better. Amusing, but no different from those who complain about Facebook changing their layout.
Great UI: Clarity and Color on the Presentation Layer
How to restore DB2 database
Or you could disallow raw SQL strings and always construct programmatically (e.g. building ASTs). All of these recurring holes are due to bad design, period. Imagine if your microwave manufacturer said "ultimately it's up to the consumer to avoid irradiating himself". Nobody expects you to be saved from sticking a drill into your face, but nor should it electrocute you by forgetting to do something.
Sunderban Tiger Roar
Sundarbans National Park provides information about Sunderban Tiger Roar. Tiger Roar Hotel Sunderbans National Park is one of the famous hotels in sunderbans. We have best tariff for Sundarban Tiger Roar Hotel followed by online booking facility.
I don't find it in any way surprising that this has happened any more than I would find it surprising that if you put a big hole in a footpath that someone would fall into it.
Marshall
Marshall Amplifier and Effects In Stock at Gear4music.com. Marshall Amps include the MG, MA, MB and Haze series. Order a Marshall Amplifier now for rapid delivery.
I agree with your points but what do you think could have been done to "convince" the Rails team to fix this? Short of the community abandoning/boycotting Rails, perhaps a revolution/spectacle was required.
I am just speculating but may be the choice whether the thumbnails are shown or not depends on empirical data of now many people have chosen to go to images.google.com (by clicking "images" link) after making a web search.
Not sure if technoweenie was trolling or not, but Homakov said on Twitter "That tattoo is kind of fake made with henna".

http://twitter.com/#!/homakov/status/176476394455437312

"Thank you all,sweethearts! For support, and shit too. One more thing to clarify. That tattoo is kind of fake made with henna. eat vegetables"
Also, the bulk of legitimate releases comes from the "leaders" of the ISO scene.. As of right now there are ~38 users in the IRC channel representing the the majority of the top level groups. To me this is absolutely frightening that a channel like this even exists.
Not all Muslim countries do though. All north african countries have a saturday/sunday weekend, except Egypt. and even in Egypt some companies make sure a subset of their employees work on their weekend because, well, most of their partners are working.
For what it's worth I thought about what I said and noticed some flaws. (Which I would correct through an edit but enough time has elapsed so that I can no longer do so.)

You mentioned pinfo, which you say still sucks. That probably IS a fault of the document format. (Which can be outputted to HTML, XML, DVI, etc, but is not itself a widely used text format.) After all, it was designed for a broken reader. And if you design something for something that's already ill designed, the end result is usually something as bad as or worse than the original article.

You also mentioned search. The thing about search is that even if the bash documentation was split into multiple parts, it's still a text file. So you could have your hypothetical man+ reader do something like:

cat /wherever/your/docs_are_stored/* | grep '-A 100' '-e search_term'

And then let you go through the matches to find what you want.
The comments are rather classy too. Glad to see xenophobia is alive and well.
Right. The benefits outweigh the disadvantages for you... until they don't.

Nearly a decade ago I worked on MMORPGs for EA. An astounding amount of game design, engineering, and customer support effort went into addressing a tiny portion of the userbase we called "griefers". Griefers may be 0.1% of the population but one griefer can create an enormous number of unhappy players. You come up with a feature and think "there's only a tiny chance that someone could use this to harass or annoy another player"... and guess what, the actual chance is near 100%. Maybe this is what bored kids do today instead of TPing houses.

The problem with simple one-click unsubscribe links is that there isn't a way to stop the griefing. One kid gets the link and never tires of clicking it. The owner has no idea who is doing it and can't stop it and gets incredibly frustrated and angry. One incredibly angry user is far more hazardous to your business than 10,000 slightly inconvenienced users.

Is this a realistic problem? I don't really know, it probably depends on your app. The stakes are a lot lower here than in an MMORPG somebody is paying $20/mo for. But when I look at the incentives, I genuinely wonder if one-click unsubscribe (or any other kind of auto-login from an email) is a good business decision. It would certainly make sense to build in some protection, like expiring after 24 hours or whatnot.

I'm very curious to know what other people on the sending side of this business think. Obviously as an email recipient you want the system to securely and anonymously read your mind and act according to your specific intention automatically all the time.
Fred Wu
So what's a good gem (if any) for safe guarding params on the controller level? @dhh's params.slice feels too dirty.
DHH ‏
yeah, it's too simple to be clean! I think you are using the wrong framework if you crave more complexity for its own sake.
Small Business Owners Gain Upper Hand with Server Colocation in Australia
I think everyone won in the end. Homakov got the credit he deserved, Rails' security flaw got a lot of attention, and GitHub had the chance to prove themselves, which in my opinion they did.
Just want to add, that you shouldn't have full brightness and contrast on on your monitor in the daylight either. First thing I do with the new monitor is cut factory set brightness to half and then play with the contrast to make it comfortable. On some monitors you should want to cut brightness even more. At first it may seem not that comfortable, but after some time eye fatigue is much less.

Also, if you're using glasses, you need a little more brightness on your monitor.

And use correct light enviroment on your workplace! Side-facing light, the usual.
Nostradamus predicts technology breakthroughs
Wow, great design. The UI is done so much better than any other education site out there.
Stuxnet: Computer worm opens new era of warfare
I had the same question; looks like the parent post is correct. I found the FAQ here:

http://mitx.mit.edu/6002x-faq.html

"How do I drop the course?

You do not have to do anything. You can simply stop working on the course at any time you choose to do so.

What happens if I drop the course?

For the prototype course, learners achieving grades of "A," "B," or "C" will receive an electronic Certificate of completion with the learner's name and grade on it. If you receive a grade below a "C" or do not complete the course, you will not receive a Certificate and no grade record attaching your name to your participation in the class will be disclosed outside of MITx. You can also choose to opt for a no record at any time. However, the posts you make while enrolled in the class will remain visible."
I love Square's work to date. The way they've changed the retail and hospitality industry for the better, and looking damn good while doing so. That being said, I can't say I'm a huge fan of the Register icon. Even the Card Case icon is strobing a bit on this monitor.
After reading the title I thought that they take over the microphone and use it to detect the email arrived sound :)
Foursquare is three years old, has around a hundred employees, and is valued (however measured) at over 500 million dollars. At what point do we stop using the word "start-up" to avoid rendering the term completely meaningless?
No, he didn't capitalize in his original post itself. Check the source of HTML. I think, it's because he's from Madurai, India (my classmate knows him well).
Square Debuts Register iPad App & Analytics; Now Processing $4B/Year
Missing the point. You have a code idiom that is insecure by default. Leaving out the slice produces working code with a critical vulnerability. Mistakes of omission are routine; people forget stuff all the time. The goal of a secure framework is to be tolerant of that kind of goof.

This API sucks rocks.
His post is dead because this comment he made: http://news.ycombinator.com/item?id=3662065

Took his karma negative, and once that happened his account was killed. As a new member you have to be careful about controversial statements until you build up a karma cushion.
There's a big difference between acknowledging that a crime can be committed, and condoning that crime when it happens.
Arch Linux ARM
Android Now the Most Popular Mobile Browser
I believe (and teach) programming the way I learn a new language ('Human' language not a computer language).

It should be segmented in a way that at the end of each segment there is a 'reward' (an application of the learning that is considered beneficial/cool by the student) and a 'desire' to learn more to achieve the bigger reward.

So typical segments for a new language could be:
- bragging/showcasing to your family and friends that you know how to count some numbers and words
- being able order food in restaurant in the new language
- communicating with someone who speaks only the new
language
- being able to enjoy a TV show/movie in the new language etc

That's why I really like Scratch tool. I can gradually introduce new capabilities (and implicitly new programming concepts).
We need such innovation (at any level - design, engineering, technology) Keep it up guys!
Must be at least 500. I'm at 488 and no downvoting yet.
Agreed. It doesn't really communicate anything about the application. It has the square logo, but those colored squares could be anything. Items or inventory aren't what come to mind. The app looks cool though.
>And likewise, for people who RTFM before using mass assignment, their applications are not vulnerable, correct?

Brilliant point. While we're all talking about this issue, lets all team up, all of us here on HN, right now, to email php-internals and ask them to bring back register_globals and turn it on by default. It was a mistake on their part to disable it. After all, who doesn't read and follow all the documentation?
HTML5 not all it is claimed to be?
Quoting the site:

"The day is March 3rd, 2012. HTML5 is touted as the newest, boldest, and highest achievement in interactivity, blessed for its ability to be cross-browser.

Despite all media sugar coating, we have found that interactivity programming is reduced to almost 1998 levels of interaction when trying to be compliant across all platforms with Javascript/HTML 5/ or open standards."

What does everyone think about this? Has this been your experience?
Awesome to see Square continuing to progress forward on a regular basis! The register app looks great!

Does anyone know if it works well (or at all) with multiple iPads? Can you view/manage the inventory online?
"The same user exploited another vulnerability". It wasn't exactly "another vulnerability". It still had to do with the same mass attribute assignment feature just in a different place.
Looks great. Very clean and fast UI. A pleasure to use and easy to navigate.

It was nice to see the textbook there. It was a little hard to read though, on my 13" screen I had to frequently scroll up and down when turning pages.

I'm guessing pdf is not an option for licensing reasons, but a vertical scroll or full screen option would be nice.
Finally someone speaks up! +1
One piece is missing: a much more robust card reader that doesn't swivel or threaten to snap in two after a day of swiping.
With regarding your second point, django middleware would be beneficial and does exactly that.
The public key form update vulnerability was based on the same concept in a different place.
Learning to avoid register_globals and magic_quotes and SQL injections in PHP is what brought many people to Rails. It's sad to see similar choices being made there too.
Buy your Peace of Mind with Mobile Parental Control Software
The thing I haven't heard a straight answer on is 1) how long has the bug existed, 2) have they proved that it wasn't previously exploited.
It's great to see a company taking an existing product (iPad) and building on top of it's powerful software and hardware.

Instead of stores having to buy some expensive & clunky cash register or crazy expensive PoS solution; they can pop down to their local Apple or electronics store & buy a future PoS device.

It's very powerful when anyone can start accepting payments by just popping down to their local electronics store.
Better to have every programmer learn to be an analyst. Practically any project could survive if the analyst was fired and the programmer had to pick up the slack, but the reverse is not true.
This could be a game changer. Restuarant management software is a space that needs innovation as well - I'd be surprised if they don't roll something out that incorporates both payments and reservations.
MCX Crude Oil Tips for Today
Get here daily crude oil tips for mcx market as well as ncdex tips for today, free commodity tips if you are looking for free trial for two days then fill free tips form so you can ask any type of question related commodity market our commodity market expert will provide you accurate tips.
Slightly tangential note - Square has the most gorgeous product videos I've seen from a startup. Their jobs section even lists an open position for doing these so I guess they do them in house. Very impressive.
“Meet New People” Space Is a Three Horse Race; LAL, Highlight, Banjo
I'm drawing up a design to make them a better stand. What they have just looks like it's waiting to get pushed off a counter.
They are only a few blocks away, I could just drop it off.