skysight-inc/HackerNews huggingface dataset:
And yet Egor made several attempts to illustrate the depth of a single problem, and nobody was able to understand that this was serious badness.

Sometimes, it is actually necessary to pull down someone else's pants to expose a problem. I think the record here speaks for itself.
Here's another shocker, cars can be driven off cliffs!! Sue Ford!
This is yet another reason to filter all messages from Facebook directly to the trash folder. The last thing I need is a constant stream of attention-sapping fb emails polluting my inbox.
If you're investigating a security situation, you don't have to say squat. Whether you were in the right or the wrong, explain what happened and apologize to those where were affected once the facts are understood, as they have done here.

It takes time and energy to come up with responses such as this (not a lot, but every bit counts in an emergency), and those are resources that you should be using the solve the problem. Not to mention that saying the wrong thing is worse than saying nothing at all.

It's basic emergency management: 1) stabilize the situation, 2) figure out what's going on, 3) fix it, and then 4) explain what happened to the stakeholders. I see nothing wrong with github's actions here.
IP addresses are circumstantial evidence for identifying a person (particularly when combined with timing and correlated with other sites, as is easy for large ad and social networks to do); it's somewhat difficult to use the web without disclosing your IP.

(Also, I feel obliged to point out your interest in this matter. You work for IAPP, which, as far as I can make out, is an association of people on the corporate side of privacy compliance.)
I think it's just one of those companies whose worth is not obvious. I suck at figuring out how services monetize their data, but as I understand, their API is nothing to scoff at.

Maybe it's more of a data service than a social service now?
I don't know whether your comment supposed to restate my question or answer it. If it's the latter, the difference is not that I'm not the one offering a service that classifies books by popularity based entirely on what I see people reading on trains. My question still stands.
We get about 15% of users with no JS (~250k visits a month, state Gov't site).
Belgium Cycling
Why Do We Need To Sleep?
Show HN: My Start-up for managing roommates
The _pragmatic_ thing to do is indeed to suspend and investigate.
Rails has the ability to protect certain fields from mass-assignment; fields where you don't want the user setting values during POST because they may be able to alter the security of that model.

Assuming this guy is right; the pub key class was allowing any old user to modify the owner_id of the pub key object and change who it belongs to. The pub key class wasn't configured to protect against mass owner_is assignment.
eBook eBook eBook eBook eBook eBook eBook eBook eBook eBook eBook eBook. (no trees were hurt in the making of this sarcastic post)
Because it's really the Model's job to determine what is safe and unsafe for mass assignment, not the controller's.
We saw some weird stuff on the account that he wasn't upfront about. Though, our first priority was clearing the bug up.
Not to mention that this happened on a Sunday.
Yes, this happened via our support system which all happens through private emails.
Writing Programs that Drive Jenkins, by Kohsuke Kawaguchi
Sorry, it's late here :)

It's the difference between selling 16 oz. tubs of Paracetamol, and packaged Tylenol pills.

Both gives you access to pain-relief, but Tylenol is a product, whereas Paracetamol is a chemical.

The savvy buyer will recognize the benefits of buying a tub of Paracetamol; very low price & high flexibility. But Tylenol will always outsell it due to convenience and packaging.

I'm just saying it's better for you to sell Tylenol.

*edit: Ok, I just realized I didn't really answer your question. My point with that specific sentence, was that you're raising the bar for customers, unless you provide something that instantly enables them to benefit from your algorithm.
Dotcom extradition papers filed
Yeah, I've worked in two shops where every developer was on guard for themselves, those were not fun situations. I can usually figure out I am in such a scenario when I ask someone if they would mind helping me by reviewing or talking through how I solved a somewhat prickly problem. If they instantly turn me down in such a way that to suggest "Not my problem, not my concern" I usually tack that onto a mental score sheet for deciding not to renew or extend my contract.

Usually I am more receptive towards teams that have a final interview stage where all of the other dev's weigh in. I've avoided some fairly toxic places because of that step.
I agree - I can care less about checking in or who checked in or local deals or coupons. Fad fad fad.
It seems to be the MTA (probably the spam filter), since it happens to me even without any client open, so there's probably no way to close it by your end.
Wrong. The system should not fail open.
This is a great response to this clusterfuck. These guys have a responsibility to react slowly and deliberately. I'm impressed they got the problem solved and two public statements out on a Sunday. This is why I'm happy to be a paying customer.
That doesn't compute in the eyes of the "law".
Start-ups Dropbox and Box reach for the cloud
... and this stunt will cost Github five to six figures.

This is fascinating to me. It would be great to learn the reasons why it will cost them so much.

(I don't doubt it; quite the contrary. I'm inexperienced and would love the opportunity to learn more about the realities of the modern security industry.)
This is true. We actually don't use mass assignment that often. He happened to catch 2 our of 3 spots that still used it. Everywhere else is explicit about what to accept.
Cheap Nike Air Max,Nike Air Max For Cheap,Nike Air Max Sale
Cheap Air Max shoes sale online with cheapest price, top quality and Fast Delivery. Buy mens & womens Nike Air Max for cheap clearance shoes at Cheapnikeairmax4sale.com.
By the look of it, yes. With well seeded torrents it actually works very nicely.
Scott Shorts
What's the song?
There is no reason to be introducing "fail open" design flaws at any level above the bare metal.
Honestly I have no idea why they didn't just ban him and say "don't hack us". It really should be that simple.
You are right in principle, but this isn't a tricky detail about email. This is fundamentally how Facebook and Google run their businesses.
That is irrelevant. The world doesn't stop turning on the weekend. It was in Github's best interests to get out ahead of this, and they did. They don't need to be commended for it just because it's Sunday.
Controlling What You See (w/View Job Filters Jenkins Plugin), by S. Connolly
Playing nice with a hacker who just broke into your service shouldn't take priority over:

1. Making sure he doesn't continue breaking into your service (by suspending his account)

2. Fixing the security flaw he used to break into your service

3. Appraising your users to the situation.

I feel for the kid--he's just 18, and if he gets some good judgment to go along with his technical skill he'll go far. But I don't understand the nerdrage at Github. People trust Github's service and their software to protect proprietary code; their response has been everything you could hope for in the interests of 100%-1 of Github stakeholders, at the expense of not communicating well to Egor why and how long they were suspending him for breaking into their service.
Quickly formatted in a gist (only slightly tongue in cheek): https://gist.github.com/1975850
Key Takeaways From The Facebook Marketing Conference
The reason this was ignored at first should be obvious: his writing is hard to read, because he isn't fluent in English. While it turned out that he did have something important to say, most broken English is noise so people filter it out instinctively.
Would love any and all feedback. Ideas, features, UX problems. Whatever you guys have I'd love to hear!
That's because there is no competition for those releases, so there is little care for quality.

If content producers released their raw sources and content monetizers had to compete to produce the best possible downloadable and distributable versions, you'd see much better commercial releases. ;-)
Unfortunately people never learn from the past. Security holes directly traceable back to the design of C are still trickling out after 30 years. The entire construction of the web has failed to learn from this lesson. The whole design is "fail open", and one mistake ends with site credentials being dumped on pastebin.
For email, it's the same reason I object to ordinary mail containing tracking devices beyond those needed to deliver the mail.

For websites, it's the same risk I take when leaving my house to visit any public place.
This little exercise reminds us that the dysfunction seen inside corporations are just as easily present in open source communities. In the end, management holds the keys to what gets checked in and what doesn't.

The curious twist in this whole tale is that PHP- because of its history of being insecure- actually had a hardened distribution, while Rails didn't.

This type of smugness creates its own karma, as evidenced by the red-faced hack of a premier RoR site.
Email should not be an interactive proposition and should have no ability whatsoever to run code.

Agreed, but HTML isn't runnable code. It's a declarative document format.
In what way do they have to prevent him from ever accessing the site from any account ever again? The best they can do is suspend his account per policy while they are investigating.
Study: Facebook profile beats IQ test in predicting job performance
The vast majority of users don't understand any tracking technology, period.
The sad part is that the guy was your biggest fan: http://homakov.blogspot.in/2011/07/octocat-tattoo.html
The problem with attachments is that you increase the bandwidth on the sender. So, instead of, say, the sender spending 2k bandwidth per mail and each recpient another 60k on bandwidth to get images when opened, the sender pays for all that extra imagery bytes. It may shift the cost in a way you prefer, but it also slows down the send so users may not get their mails in a reasonable time, and may not appreciate the larger mails filling up their boxes.

There is also the issue with referencing the inline images, though I've been told that it's not such a big deal (I've never tried it myself).

As for the "going down", most reputable email vendors have pretty well done image servers, for this very reason. But yes, if the user disconnects, the images won't be available. But same with the web site that the email is linked to, so users couldn't necessarily click for more info either.

But commercial emails usually aren't designed to be saved and re-referenced like mails from friends. Instead, they expect to be read while online, and either reacted to quickly or discarded. I guess it's similar to the mindset with paper mail.

Too bad there isn't more effort on making better mails that don't rely on images but instead make better experiences... instead of better tracking tech.
Oddly, I don't feel that GitHub is being upfront with everything that's going on here. It appears to be a very complicated story, but it was presented in an entirely different manner. I recognize that it's difficult to present a coherent story when everything is playing out in real time on the web, but the blog posts seem to have shared just the wrong amount of information.
You could also just tell Facebook to not email you.
this stunt will cost Github five to six figure

It will cost its customers a lot more to reaudit all their commits from the date they migrated to GitHub. How can any one be certain at this stage that there hasn't been a 0-day inserted into their project?
i doubt this audience is going to be receptive to a site that requires a facebook login. it's probable you have other demographics in mind though.
Why are we scared to design less?
Ok, that is good to hear. Trust restored :) I was fearing you were using unsafe mass assignment everywhere...

Would you mind sharing any patters you use to DRY up explicit assignment?
You need to change doctors. Any doctor worth their salt would have made this diagnosis. Seriously.

You should see a gastroenterologist for proper treatment of your reflux.
Can you place design at the core of an old company?
... if you want to take a US-centric view of things, then that last statement is correct I suppose... but not everyone is subject to US laws - including, unless I am grossly mistaken, the person you refer to.
But when the model is accessed from four different controllers representing different privilege levels (e.g. public profile page, user settings page, internal admin page) and user experiences, is it really still the model's job to figure out which incoming updates are allowed to update which fields?

This is "thin controllers" gone too far -- the model shouldn't have to figure out where it's being updated from and what to allow.
Maybe I missed something, but from looking through his posts, it seems that Egor felt the defaults in Rails were insecure (let's face it, they are), and then when he didn't get the immediate feedback from the rails team that he had hoped for, he decided to illustrate his point by hacking Github, which happens to be built on Rails. Nowhere did I read, on his own blog or within any of the rails issue tickets, that he actually tried reaching out to Github (i.e. contacting security@github.com) before exploiting the vulnerability.

Maybe he did try to contact Github first, but I didn't see anything mentioning that in any of the linked posts.
How the iPad 3 could take touch screens to the next level
Yeah, the facebook authentication is kind of a double edged sword. We want it because it will make it easy for users to invite their roommates, and more importantly, it allows us to have the concept of an "identity" to tie actions to. Going forward this could let us create a sort of roommate-resume tied to your identity.
Apple's key insight was that a touch screen demands a completely different UI than a mouse & keyboard. I predict that all these hybrid approaches are doomed to niche status. The impedance mismatch going back and forth between devices is a software problem that will be solved by deeper cloud integration.
I haven't heard a single kind thing about GitHub's code from people who've deployed their FI, or more recently, enterprise product.

They've got some talented people, but I'm guessing from their posts speaking of how they work that they don't have much in the way of code review.
IMO the best location for private repositories is your own equipment. Or rented equipment but with the private code and data on encrypted block devices or filesystems.

I know it can be a faf to setup proper reliable secure backups and so forth (though with git it shouldn't be too hard give the whole thing is designed with wide but efficient distribution in mind), but if you stuff is sensitive enough (in a business sense, some other financial sense, or for more personal reasons) to care about keeping private then I would think twice before trusting a third party with the data. No matter how trustworthy, reliable, and secure they try to be, every one makes mistakes.

Maybe I'm just paranoid. Or just plain old fashioned. But "everything in the cloud" just scares me. Keep public stuff on public services by all means, but keep your private stuff under greater control.
in "the eyes of the law" the charge would not be theft either
Planting the Seed for a Responsive Future
Honestly, I am less likely to want to use github in light of this announcement. You handled this incident badly, and then didn't acknowledge it, nor offer the much-needed props to Egor for exposing an issue you guys didn't think was serious.

If this is how you react to someone who WANTS to tell you about a serious problem, how what percentage of the people who don't love you enough to put a tattoo on themselves are likely to report an issue versus sell this to one of the many buyers of 'sploits who exist out there?

The reality is that these folks generally don't want to hurt you, they just want you to understand the thing you won't admit. When it happens, and you've got egg on your face, grow a pair and cop up to the fact that you/the system failed, and GIVE PROPS. Fix the issue, move on, and award the guy who did you a solid by finding an issue his 15 minutes of fame.
To win this fight, you need to convince users (and not just the techies on HN) to care. You aren't going to convince site operators to hamstring themselves over an issue their users don't care about. (Even if you do, unless you win over ever single site, all you will do is kill the ethical operators and leave the unethical one standing, let like antibiotic resistant bacteria. Is that really what you want? )
Following this train of thought simply leads to a further moral dilemma. If the concern is that Instapaper is bad because it bypasses the content providers income methodology then Readability is also bad because it does the exact same thing. The only difference is that Readability has created their own income methodology, of which a portion they feed back to the content providers (sometimes). At no point does either service require a content provider opt-in before the service's users are able to pull content from the providers.

I believe Instapaper has an opt-out function for content providers whereby Instapaper users are prevented from adding that content providers content to their Instapaper account. Does Readability have that opt-out capability as well? If not, Readability could very well be considered worse than Instapaper on a moral scale since Readability then becomes a form of blackmail: agree to accept payment for your content that we decide is just, otherwise we'll simply eliminate your existing payment method anyway.

I fail to see how any moral analysis of either service could conclude one is good and the other bad. They are both bad from the perspective of the average content provider. Half measures, and possibly blackmail, do not assuage the moral concern.
How would you be losing sleep now? Assuming you were Github, as of now you would have (1) identified the problem, (2) fixed the issue, (3) handled the public relations with a press release that includes a future disclosure policy. You probably blew some cash on overtime pay this weekend, but how do you count 5-6 figures?

Any company that is paranoid enough to cut their Github contract following a benign intrusion that was resolved in under 24 hours is not a company that would have uploaded code in the first place. This is not the only security vulnerability on Github.

I think you are being excessively dramatic.
I tell founders to actually use the term "handshake deal." Then there is no uncertainty.
Google hasn't said it they have done it(I don't follow Google that closely so I don't know if it is the Panda update or what). There have been several SO content clones. Some ranked higher than SO for given queries even after the update that was aimed at low quality content(the only reason I heard of it is because it generated a few HN articles). When that was mentioned on HN a couple of Googlers asked for examples so they could "Fix it".
The immediate feedback was multiple issues closed as if they were not serious.
> However, unlike the four fin system, three fins cannot be controlled by a human. To turn left, the top fin needs to be deflected, while the two angled fins need to be deflected by an amount which can only be computed by the sine and cosine of 2π/3 radians times the deflection of the top fin. Turning while climbing becomes even more complicated.

This is like saying that no human could hope to catch a ball flying through the air because it would require doing ballistic calculations in one's head.

I think the author should investigate the combination of control surface manipulations needed to make a coordinated turn in an aircraft, or doing a crosswind landing.

Or if he really wants to have is mind blown: how helicopters are flown.
Sounds like sarcasm to me.
HTML isn't what bugs you. Unauthorized loading of remote content is what bugs you. That's a misfeature of your (and most people's) mail reader.
So does that mean we should focus on convenience and usability? :)

Thanks for the response by the way!
For a Few Users More - Nearing 1K Actives After 2 Weeks
The Beauty of a Second
FBSense...Selling your friends :) 
A trivial argument against Facebook closed wall garden...
The problem with attachments is that you increase the bandwidth on the sender. So, instead of, say, the sender spending 2k bandwidth per mail and each recpient another 60k on bandwidth to get images when opened, the sender pays for all that extra imagery bytes.

But wouldn't the sender have to serve the images over HTTP anyway? Unless you expect a big percentage of those emails to never be opened, but then I have to wonder if you should be sending them in the first place.
We...don't? I mean, if you're reliant on cloud services, yeah, you'll have problems--that's obvious. But if you self-host your important stuff (I run my own redmine instance off a local machine) and know how to use SSH, you should be fine in the majority of cases where the LAN is fine but has no Internet access.

There's nothing "broken" here.
Actually, Foursquare became a lot more interesting to me as a user in the past 6 months. It finally has enough coverage that I can reliably assume a place always has foursquare, the mobile client (at least on iOS) is nice, there are enough badges (which aren't NYC-specific) to keep it entertaining, and they're starting to do some really interesting things (the Amex Whole Foods promotion, for instance). They also are putting great discovery features in the app -- menus and hours, which is the main thing I use Yelp for (since the quality of Yelp reviews is so often hit or miss, I care a lot more about where my friends go).

People have been talking about location-based apps for 30-50 years. Dennis Crowley has been working on them in various forms for a decade. I don't see why you'd think they don't have a place in the future, unless you think people are going to stop going out and doing stuff.
Lindsay Lohan's Saturday Night Live The Best of the Season?
> What do you mean "properly deploy their app"?

No matter how bad the tool actually is, only a terrible craftsman blames his tools. That's what he meant.

Both Rails and GH are at fault. Rails for not discouraging poor practices and GH for not being more familiar with their own stack.
From reading many of the curiously well-informed comments, I suspect that the reason for standardization has to do with speed and validation for credit. Since it sounds like "scene" people arbitrage new releases across scene FTP drop sites for upload credit, a standard method of "settling accounts" via scripts/bots would be useful. Arbitrage would be less efficient if files had to be transcoded between FTP sites.
Personally, I think analytics is fine as long as you run them from the same domains as the website. Using e.g. Google Analytics allows them to track users across multiple sites, which is much more dangerous, in my opinion, and should be avoided.

I use Piwik on my own sites and will never share that data with anyone.
> I wonder if his poor English [...] contributed to him not being taken seriously?

I'd say that's very likely the case. Unfortunate, but, in some ways, understandable. If a person is not able to articulate an issue effectively dismissing them becomes too easy. We all do it.
We use this (posted by @dhh) https://gist.github.com/1975644 in some spots, or simply just Hash#slice. We have some other thoughts on making params access more explicit. The problem with explicit patterns is they can get left out if a developer forgets.
I figured it they were doing this they would have made it so when you opened a notification via email it would mark it as read within the Facebook site, but it doesn't. That would be a nice feature and purpose for the tracker image.